Supported Plugin Configurations

Device Intelligence supports integration with the following plugins:

• Tanium
• Qualys
• ServiceNow
• Infoblox
• Microsoft Entra ID (formerly Azure AD)
• Forescout
• SentinelOne
• Tenable
• Kaseya VSA
• SuperOps
• Crowdstrike

This article provides detailed information for each plugin.

Tanium Integration

The Tanium plugin retrieves inventoried device data from the Assets module.

Required Configuration Parameters

• Tanium Host: Instance URL of the Tanium platform
• API Token: API token for the Tanium instance

Device Attributes

Device Intelligence maps the following fields from Tanium:

Tanium Source Field	Data Type
ci_network_adapter.mac_address	String
system_uuid	String
user_name[:32]	String
computer_name	String
ip_address	String
city, country	String
last_seen_at	String
manufacturer	String
model	String
operating_system	String
os_version	String
serial_number	String

Qualys Integration

The Qualys plugin retrieves asset inventory and vulnerability data from the Qualys platform.

Required Configuration Parameters

• Username: Username for the Qualys instance
• Password: Password for the Qualys instance
• Qualys API Gateway URL: API gateway URL of the Qualys platform

Device Attributes

Device Intelligence maps the following fields from Qualys:

Qualys Source Field	Data Type
networkInterfaceListData.networkInterface[i].macAddress	String
assetUUID	String
hardware.category	String
lastModifiedDate	String
assetName	String
address	String
lastLocation.name	String
hardware.manufacturer	String
hardware.model	String
operatingSystem.osName	String
operatingSystem.version	String
assetType	String
tagList.tag.tagName	String
agent.version	String
userAccountListData.userAccount.name	String
reference	String
launch_date	Date/Time
qid	String
title	String
severity	String
port	String
cve_id	String
category	String

ServiceNow Integration

The ServiceNow plugin retrieves asset data from the ServiceNow alm_asset table.

Required Configuration Parameters

• ServiceNow URL: Instance URL of the ServiceNow platform
• Username: Username for the ServiceNow instance
• Password: Password for the ServiceNow instance

Device Attributes

Device Intelligence maps the following fields from ServiceNow:

ServiceNow Source Field	Data Type
ci.mac_address	String
sys_id	String
model_category.name	String
sys_updated_on	String
display_name	String
ci.ip_address	String
ci.location.name	String
ci.manufacturer.name	String
model.name	String
serial_number	String
asset_tag	String
assigned_to.user_name	String
sys_created_by	String
ci.sys_class_name	String
ci.sys_class_name.os_version	String

Infoblox Integration

The Infoblox plugin retrieves active DHCP lease data from the Infoblox platform.

Required Configuration Parameters

• Infoblox URL: Instance URL of the Infoblox platform
• Username: Username for the Infoblox instance
• Password: Password for the Infoblox instance

Device Attributes

Device Intelligence maps the following fields from Infoblox:

Infoblox Source Field	Data Type
hardware	String
address	String
client_hostname	String
server_host_name	String
username	String
discovered_data.os	String
discovered_data.device_location	String
discovered_data.device_model	String
discovered_data.device_vendor	String
discovered_data.device_type	String

Microsoft Entra ID Integration

The Microsoft Entra ID plugin retrieves managed device data from Microsoft Entra ID.

Required Configuration Parameters

• Tenant ID: Tenant ID of the Microsoft Entra ID platform
• Client ID: Application (client) ID
• Client Secret: Client secret value

Device Attributes

Device Intelligence maps the following fields from Microsoft Entra ID:

Entra ID Source Field	Data Type
ethernetMacAddress	String
id	String
lastSyncDateTime	String
operatingSystem	String
osVersion	String
deviceCategoryDisplayName	String
userDisplayName	String
model	String
manufacturer	String
serialNumber	String

Forescout Integration

The Forescout plugin retrieves device inventory data discovered by the Forescout platform.

Required Configuration Parameters

• Forescout Host: Base URL of the Forescout platform (for example, https://<instance>). Do not include trailing slashes or paths.
• API Token: Bearer token used to authenticate API requests.
• SSL Validation: Enable to validate SSL certificates (default). Disable only for test environments.

Device Attributes

Device Intelligence maps the following fields from Forescout:

Forescout Source Field	Max Length	Min Length
ip_addresses[0]	—	—
mac_addresses[0]	—	—
rem_os	128 chars	2 chars
rem_vendor	64 chars	2 chars
rem_category	32 chars	2 chars
id	128 chars	2 chars

SentinelOne Integration

The SentinelOne plugin retrieves managed device data from SentinelOne.

Required Configuration Parameters

• Base URL: Base URL of the SentinelOne Console URL.
• API token: Bearer token used to authenticate API requests.

Device Attributes

Device Intelligence maps the following fields from SentinelOne:

SentinelOne Source Field	Data Type
source_id	String
hostname	String
ip	String
mac_address	String
os	String
os_version	String
category	String
type	String
serial_number	String
manufacturer	String
model_name	String
location	String
lastseen	String
tags	List[str]

Tenable Integration

The Tenable plugin retrieves managed device data from Tenable.

Required Configuration Parameters

• Tenable URL: Base URL for Tenable.
• Tenable Secret key: Username for Tenable.
• Tenable Access key: Passwork for Tenable.

Device Attributes

Device Intelligence maps the following fields from Tenable:

Tenable Source Field	Data Type
ipv4[i]	String
mac_address[i]	String
hostname[i]	String
id	String
site_id	String
last_seen	String
created_at	String
operating_system[i]	String
serial[i]	String
model[i]	String
has_agent	Boolean
user[i]	String
plugin_id	Integer
plugin_name	String
severity	Integer
cve[i]	Array<String>
plugin_family	String
family	String
asset id (hyphens stripped)	String
pull execution time	String
literal true	Boolean
attributes[i].attribute_value	String

Fields marked [i] come back as a list in the Tenable payload; the plugin takes the first element.

Kaseya VSA Integration

Required Configuration Parameters

• Kaseya VSA URL: Base URL for Kaseya VSA tenant.
• API Credentials: API credentials to access Kaseya VSA tenant

Device Attributes

Device Intelligence maps the following fields from Kaseya VSA:

Kaseya VSA Source Field	Data Type
Name	String
LocalIpAddresses[].IpV4	String
LocalIpAddresses[].PhysicalAddress	String
AssetInfo[System].CategoryData.Manufacturer → fallback: Type	String
Description	String
ClientVersion	String
AssetInfo[0].CategoryName	String
Type	String
Group Name	String
Identifier	String
AssetInfo[BIOS].CategoryData[‘Serial Number’]	String
AssetInfo[System].CategoryData.Model	String
Tags	List

SuperOps Integration

Required Configuration Parameters

• SuperOps API URL: Base URL for SuperOps tenant
• Customer Subdomain: subdomain name
• API Token: API token for the SuperOps instance

Device Attributes

SuperOps Source Field	Data Type
assetId	String
hostName	String
primaryMac	String
gateway	String
loggedInUser	String
serialNumber	String
manufacturer	String
model	String
platform	String
platformVersion	String
assetClass	String
site	String
lastCommunicatedTime	String

CrowdStrike Integration

Configuration Parameters

• CrowdStrike API Base URL: Base URL for CrowdStrike tenant.
• Client (Application) ID: Client ID of the CrowdStrike Falcon API client.
• Client Secret: Client secret of the CrowdStrike Falcon API client.

Device Attributes

CrowdStrike Source Field	Data Type
device_id	String
hostname	String
mac_address	String
local_ip	String
last_login_user	String
last_seen	String (ISO 8601, UTC)
chassis_type_desc	String
product_type_desc	String
system_manufacturer	String
system_product_name	String
serial_number	String
os_version	String
site_name	String
tags	List[str]