Device Intelligence supports integration with the following plugins:
- Tanium
- Qualys
- ServiceNow
- Infoblox
- Microsoft Entra ID (formerly Azure AD)
- Forescout
- SentinelOne
- Tenable
- Kaseya VSA
- SuperOps
- Crowdstrike
This article provides detailed information for each plugin.
Tanium Integration
The Tanium plugin retrieves inventoried device data from the Assets module.
Required Configuration Parameters
- Tanium Host: Instance URL of the Tanium platform
- API Token: API token for the Tanium instance
Device Attributes
Device Intelligence maps the following fields from Tanium:
| Tanium Source Field | Data Type |
|---|---|
| ci_network_adapter.mac_address | String |
| system_uuid | String |
| user_name[:32] | String |
| computer_name | String |
| ip_address | String |
| city, country | String |
| last_seen_at | String |
| manufacturer | String |
| model | String |
| operating_system | String |
| os_version | String |
| serial_number | String |
Qualys Integration
The Qualys plugin retrieves asset inventory and vulnerability data from the Qualys platform.
Required Configuration Parameters
- Username: Username for the Qualys instance
- Password: Password for the Qualys instance
- Qualys API Gateway URL: API gateway URL of the Qualys platform
Device Attributes
Device Intelligence maps the following fields from Qualys:
| Qualys Source Field | Data Type |
|---|---|
| networkInterfaceListData.networkInterface[i].macAddress | String |
| assetUUID | String |
| hardware.category | String |
| lastModifiedDate | String |
| assetName | String |
| address | String |
| lastLocation.name | String |
| hardware.manufacturer | String |
| hardware.model | String |
| operatingSystem.osName | String |
| operatingSystem.version | String |
| assetType | String |
| tagList.tag.tagName | String |
| agent.version | String |
| userAccountListData.userAccount.name | String |
| reference | String |
| launch_date | Date/Time |
| qid | String |
| title | String |
| severity | String |
| port | String |
| cve_id | String |
| category | String |
ServiceNow Integration
The ServiceNow plugin retrieves asset data from the ServiceNow alm_asset table.
Required Configuration Parameters
- ServiceNow URL: Instance URL of the ServiceNow platform
- Username: Username for the ServiceNow instance
- Password: Password for the ServiceNow instance
Device Attributes
Device Intelligence maps the following fields from ServiceNow:
| ServiceNow Source Field | Data Type |
|---|---|
| ci.mac_address | String |
| sys_id | String |
| model_category.name | String |
| sys_updated_on | String |
| display_name | String |
| ci.ip_address | String |
| ci.location.name | String |
| ci.manufacturer.name | String |
| model.name | String |
| serial_number | String |
| asset_tag | String |
| assigned_to.user_name | String |
| sys_created_by | String |
| ci.sys_class_name | String |
| ci.sys_class_name.os_version | String |
Infoblox Integration
The Infoblox plugin retrieves active DHCP lease data from the Infoblox platform.
Required Configuration Parameters
- Infoblox URL: Instance URL of the Infoblox platform
- Username: Username for the Infoblox instance
- Password: Password for the Infoblox instance
Device Attributes
Device Intelligence maps the following fields from Infoblox:
| Infoblox Source Field | Data Type |
|---|---|
| hardware | String |
| address | String |
| client_hostname | String |
| server_host_name | String |
| username | String |
| discovered_data.os | String |
| discovered_data.device_location | String |
| discovered_data.device_model | String |
| discovered_data.device_vendor | String |
| discovered_data.device_type | String |
Microsoft Entra ID Integration
The Microsoft Entra ID plugin retrieves managed device data from Microsoft Entra ID.
Required Configuration Parameters
- Tenant ID: Tenant ID of the Microsoft Entra ID platform
- Client ID: Application (client) ID
- Client Secret: Client secret value
Device Attributes
Device Intelligence maps the following fields from Microsoft Entra ID:
| Entra ID Source Field | Data Type |
|---|---|
| ethernetMacAddress | String |
| id | String |
| lastSyncDateTime | String |
| operatingSystem | String |
| osVersion | String |
| deviceCategoryDisplayName | String |
| userDisplayName | String |
| model | String |
| manufacturer | String |
| serialNumber | String |
Forescout Integration
The Forescout plugin retrieves device inventory data discovered by the Forescout platform.
Required Configuration Parameters
- Forescout Host: Base URL of the Forescout platform (for example, https://<instance>). Do not include trailing slashes or paths.
- API Token: Bearer token used to authenticate API requests.
- SSL Validation: Enable to validate SSL certificates (default). Disable only for test environments.
Device Attributes
Device Intelligence maps the following fields from Forescout:
| Forescout Source Field | Max Length | Min Length |
|---|---|---|
| ip_addresses[0] | — | — |
| mac_addresses[0] | — | — |
| rem_os | 128 chars | 2 chars |
| rem_vendor | 64 chars | 2 chars |
| rem_category | 32 chars | 2 chars |
| id | 128 chars | 2 chars |
SentinelOne Integration
The SentinelOne plugin retrieves managed device data from SentinelOne.
Required Configuration Parameters
- Base URL: Base URL of the SentinelOne Console URL.
- API token: Bearer token used to authenticate API requests.
Device Attributes
Device Intelligence maps the following fields from SentinelOne:
| SentinelOne Source Field | Data Type |
|---|---|
| source_id | String |
| hostname | String |
| ip | String |
| mac_address | String |
| os | String |
| os_version | String |
| category | String |
| type | String |
| serial_number | String |
| manufacturer | String |
| model_name | String |
| location | String |
| lastseen | String |
| tags | List[str] |
Tenable Integration
The Tenable plugin retrieves managed device data from Tenable.
Required Configuration Parameters
- Tenable URL: Base URL for Tenable.
- Tenable Secret key: Username for Tenable.
- Tenable Access key: Passwork for Tenable.
Device Attributes
Device Intelligence maps the following fields from Tenable:
| Tenable Source Field | Data Type |
|---|---|
| ipv4[i] | String |
| mac_address[i] | String |
| hostname[i] | String |
| id | String |
| site_id | String |
| last_seen | String |
| created_at | String |
| operating_system[i] | String |
| serial[i] | String |
| model[i] | String |
| has_agent | Boolean |
| user[i] | String |
| plugin_id | Integer |
| plugin_name | String |
| severity | Integer |
| cve[i] | Array<String> |
| plugin_family | String |
| family | String |
| asset id (hyphens stripped) | String |
| pull execution time | String |
| literal true | Boolean |
| attributes[i].attribute_value | String |
Fields marked [i] come back as a list in the Tenable payload; the plugin takes the first element.
Kaseya VSA Integration
Required Configuration Parameters
- Kaseya VSA URL: Base URL for Kaseya VSA tenant.
- API Credentials: API credentials to access Kaseya VSA tenant
Device Attributes
Device Intelligence maps the following fields from Kaseya VSA:
| Kaseya VSA Source Field | Data Type |
|---|---|
| Name | String |
| LocalIpAddresses[].IpV4 | String |
| LocalIpAddresses[].PhysicalAddress | String |
AssetInfo[System].CategoryData.Manufacturer → fallback: Type | String |
| Description | String |
| ClientVersion | String |
| AssetInfo[0].CategoryName | String |
| Type | String |
| Group Name | String |
| Identifier | String |
| AssetInfo[BIOS].CategoryData[‘Serial Number’] | String |
| AssetInfo[System].CategoryData.Model | String |
| Tags | List |
SuperOps Integration
Required Configuration Parameters
- SuperOps API URL: Base URL for SuperOps tenant
- Customer Subdomain: subdomain name
- API Token: API token for the SuperOps instance
Device Attributes
| SuperOps Source Field | Data Type |
|---|---|
| assetId | String |
| hostName | String |
| primaryMac | String |
| gateway | String |
| loggedInUser | String |
| serialNumber | String |
| manufacturer | String |
| model | String |
| platform | String |
| platformVersion | String |
| assetClass | String |
| site | String |
| lastCommunicatedTime | String |
CrowdStrike Integration
Configuration Parameters
- CrowdStrike API Base URL: Base URL for CrowdStrike tenant.
- Client (Application) ID: Client ID of the CrowdStrike Falcon API client.
- Client Secret: Client secret of the CrowdStrike Falcon API client.
Device Attributes
| CrowdStrike Source Field | Data Type |
|---|---|
| device_id | String |
| hostname | String |
| mac_address | String |
| local_ip | String |
| last_login_user | String |
| last_seen | String (ISO 8601, UTC) |
| chassis_type_desc | String |
| product_type_desc | String |
| system_manufacturer | String |
| system_product_name | String |
| serial_number | String |
| os_version | String |
| site_name | String |
| tags | List[str] |