Axonius

Asset Management

Overview

The Axonius connector integrates with the Axonius cybersecurity asset management platform to synchronize device and user asset data. It retrieves comprehensive asset inventories including network information, operating system details, identity attributes, and security posture metadata.

Data retrieved from Axonius Connector

Connector Object	Required	Maps to Data Model
Device	Yes	Host
User	Yes	Person

Model relationships

note

For detailed steps on how to view the data retrieved from Axonius Connector in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Axonius Connector from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Axonius URL	Yes	—	Axonius instance URL
API key	Yes	—	Axonius API key
API secret	Yes	—	Axonius API secret
User custom properties	No	—	Comma delimited list of case-insensitive custom property names to promote as attributes on the User.
Device custom properties	No	—	Comma delimited list of case-insensitive custom property names to promote as attributes on the Device.
Page size	No	100	Maximum number of records to get per API request
Parallel requests	No	min(4, availableProcessors)	Maximum number of parallel API requests
Maximum retries	No	10	The maximum number of retry attempts before giving up a request
SSL / TLS	No	false	Skip certificate verification

Authentication

The connector authenticates with the Axonius REST API using an API key and API secret issued from the Axonius console (My Account → API Key). These credentials are sent as custom headers on every request — there is no token-exchange or OAuth flow.

Endpoints

Method	URL	Purpose
POST	{url}/api/users	Connectivity test / fetch user assets
POST	{url}/api/devices	Fetch device assets

{url} is the configured Axonius instance base URL.

Request Headers

Header	Value
Content-Type	application/json
api-key	<your-api-key>
api-secret	<your-api-secret>

Connectivity Test Request Body

The connector verifies credentials by issuing a minimal POST /api/users request that retrieves a single record:

{
  "data": {
    "type": "entity_request_schema",
    "attributes": {
      "page": { "offset": 0, "limit": 1 },
      "fields": {
        "users": ["specific_data.data.username"]
      }
    }
  }
}

Sample Response

{
  "data": [
    {
      "type": "entities_details_schema",
      "attributes": {
        "internal_axon_id": "a1b2c3d4e5f6...",
        "adapters": ["active_directory_adapter"],
        "labels": ["Production"],
        "specific_data.data.username": ["jdoe"]
      }
    }
  ],
  "meta": {
    "page": {
      "number": 1,
      "size": 1,
      "totalPages": 1200,
      "totalResources": 1200
    }
  }
}

Response Fields

Field	Type	Description
data[]	array	List of asset records for the page.
data[].type	string	Schema type of the record (e.g. entities_details_schema).
data[].attributes	object	Flat map of requested field names to values (the internal_axon_id plus each selected specific_data.data.* field).
meta.cursor	string	Optional pagination cursor.
meta.page.number	integer	Current page number.
meta.page.size	integer	Page size used.
meta.page.totalPages	integer	Total number of pages available.
meta.page.totalResources	integer	Total number of matching assets.

Usage

A successful (HTTP 2xx) response to the connectivity test confirms the credentials. The api-key and api-secret headers are attached to every subsequent asset request — no session token is stored or reused.

---

Sync Behavior

Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.

---

How to obtain Axonius Connector credentials

Obtain the required credentials (url, apiKey, apiSecret) from your Axonius Connector administrator or the Axonius Connector admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Device

Source Field Name	SDM Attribute
adapters	adapters
adapters + labels	TAGS
Derived	CATEGORIES
Derived from FQDN	PRIVATE_DNS_NAMES
Derived from FQDN	PUBLIC_DNS_NAMES
Derived from IPs	PRIVATE_IP_ADDRESSES
Derived from IPs	PUBLIC_IP_ADDRESSES
Generated	STATUS
Generated	LAST_CAPTURED
internal_axon_id	UID
internal_axon_id	internal_axon_id
labels	labels
specific_data.data.boot_time_preferred	BOOT_TIME
specific_data.data.cloud_id	INSTANCE_ID
specific_data.data.cloud_id	CLOUD_ID
specific_data.data.device_manufacturer_preferred	MANUFACTURER
specific_data.data.domain_preferred	DOMAIN
specific_data.data.first_seen	FIRST_SEEN
specific_data.data.hostname_fqdn_preferred	DNS_NAMES
specific_data.data.hostname_fqdn_preferred	FQDN
specific_data.data.hostname_preferred	HOSTNAMES
specific_data.data.hostname_preferred	HOSTNAME
specific_data.data.is_virtual_preferred	IS_VIRTUAL
specific_data.data.is_windows_server_preferred	IS_WINDOWS_SERVER
specific_data.data.last_seen	LAST_SEEN
specific_data.data.name_preferred	DEVICE_NAME
specific_data.data.name_preferred / hostname_preferred / hostname_fqdn_preferred	NAME
specific_data.data.network_interfaces.ips_preferred	IP_ADDRESSES
specific_data.data.network_interfaces.ips_v4_preferred	IPV4_ADDRESSES
specific_data.data.network_interfaces.ips_v6_preferred	IPV6_ADDRESSES
specific_data.data.network_interfaces.mac_preferred	MAC_ADDRESSES
specific_data.data.os.build_preferred	OS_BUILD
specific_data.data.os.distribution_preferred	OS_DISTRIBUTION
specific_data.data.os.os_str_preferred	DESCRIPTION
specific_data.data.os.os_str_preferred	OPERATING_SYSTEM
specific_data.data.os.type_preferred	OS_TYPE
specific_data.data.serial_number_preferred	SERIAL_NUMBER
specific_data.data.uptime_preferred	UPTIME
specific_data.data.user_preferred	LAST_LOGIN_USER

User

Source Field Name	SDM Attribute
adapters	adapters
adapters + labels	TAGS
Derived	CATEGORIES
Generated	STATUS
Generated	LAST_CAPTURED
internal_axon_id	UID
internal_axon_id	internal_axon_id
labels	labels
specific_data.data.account_disabled	ACCOUNT_DISABLED
specific_data.data.account_expired	ACCOUNT_EXPIRED
specific_data.data.account_expires	ACCOUNT_EXPIRES
specific_data.data.account_state	ACCOUNT_STATE
specific_data.data.cloud_provider	CLOUD_PROVIDER
specific_data.data.days_until_password_expiration	DAYS_UNTIL_PASSWORD_EXPIRATION
specific_data.data.description	DESCRIPTION
specific_data.data.description	USER_DESCRIPTION
specific_data.data.display_name	NAME
specific_data.data.display_name	DISPLAY_NAME
specific_data.data.domain	DOMAIN
specific_data.data.employee_id	EMPLOYEE_ID
specific_data.data.employee_type	EMPLOYEE_TYPE
specific_data.data.first_name	FIRST_NAME
specific_data.data.first_name	USER_FIRST_NAME
specific_data.data.first_seen	FIRST_SEEN
specific_data.data.id	USER_ID
specific_data.data.is_admin	IS_ADMIN
specific_data.data.is_delegated_admin	IS_DELEGATED_ADMIN
specific_data.data.is_local	IS_LOCAL
specific_data.data.is_locked	IS_LOCKED
specific_data.data.is_managed_by_application	IS_MANAGED_BY_APPLICATION
specific_data.data.is_managed_by_sso	IS_MANAGED_BY_SSO
specific_data.data.is_mfa_enforced	IS_MFA_ENFORCED
specific_data.data.is_mfa_enrolled	IS_MFA_ENROLLED
specific_data.data.is_orphaned	IS_ORPHANED
specific_data.data.is_saas_user	IS_SAAS_USER
specific_data.data.last_logon	LAST_LOGIN
specific_data.data.last_name	LAST_NAME
specific_data.data.last_name	USER_LAST_NAME
specific_data.data.last_password_change	LAST_PASSWORD_CHANGE
specific_data.data.last_seen	LAST_SEEN
specific_data.data.logon_count	LOGON_COUNT
specific_data.data.mail	EMAILS
specific_data.data.organizational_unit	ORGANIZATIONAL_UNIT
specific_data.data.password_expiration_date	PASSWORD_EXPIRATION_DATE
specific_data.data.password_never_expires	PASSWORD_NEVER_EXPIRES
specific_data.data.password_not_required	PASSWORD_NOT_REQUIRED
specific_data.data.user_city	USER_CITY
specific_data.data.user_created	USER_CREATED
specific_data.data.user_sid	USER_SID
specific_data.data.user_status	USER_STATUS
specific_data.data.user_telephone_number	PHONE_NUMBERS
specific_data.data.user_type	USER_TYPE
specific_data.data.username	USERNAME

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Device

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Device on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /api/devices

User

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of User on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /api/users

Changelog

Changelog

The Axonius Connector connector has undergone the following changes:

Version	Description	Migration Steps
3.0.7	Improvements - Failed Axonius API requests during synchronization now report the HTTP status code and identify the request that failed — endpoint, page offset, and page size — alongside the message Axonius returned. Previously only Axonius's own text was surfaced (for example, Could not create filter.), which was not enough to tell what had failed or where, making interrupted synchronizations difficult to diagnose from agent logs. This makes such a failure identifiable in the agent log; it does not prevent the failure itself. - When a synchronization is aborted by a failing page request, the log now records the endpoint and the page position it had reached, so the point of failure is identifiable in a long-running sync. - Failures originating below the API layer, such as network timeouts and unreadable responses, now name the underlying error in the reported message instead of surfacing only its text, while remaining subject to the connector's normal retry behavior. - When Axonius serves fewer records per page than the configured Page size, the log now reports the size it is actually being given and synchronization continues at that size. Previously an over-large Page size could quietly reduce how much data was collected, with nothing in the log to indicate it. - Synchronization no longer requests pages past the end of the dataset. It now uses the record count Axonius reports for the query to stop at the last page with data, where every run previously finished by requesting several pages beyond the last record — roughly the Parallelism level multiplied by the Page size worth of records past the end. This spends fewer requests against the Axonius API and keeps page offsets within the range the data occupies, rather than reaching well beyond it on large tenants. - Attribute consolidation precedence. The standard Brinqa attributes this connector populates — such as name, status, categories, tags, and first and last seen — now participate in consolidation at the platform's default priority instead of being last-in. When the same record receives values from multiple sources, the values this connector reports for those attributes now take precedence over non-connector data sources (UI edits, manual imports, bulk uploads), matching how other Brinqa connectors behave. Attributes this connector declares itself are unchanged, including its operating-system detail, hostname and FQDN, and user identity and account attributes. Bug Fixes - Device and User synchronization no longer ends early when Axonius returns a partial page. A page smaller than the configured Page size was treated as the end of the data, so where Axonius serves smaller pages than requested — reachable by setting Page size higher than Axonius allows — a synchronization could complete and report success after collecting only a fraction of the assets. Synchronization now continues until it reaches the record count Axonius reports for the query.	N/A
3.0.6	Improvements - Device manufacturer, last login user, and operating system attributes now map to standard Brinqa UDM attributes - User cloud provider and last login attributes now map to standard Brinqa UDM attributes Bug Fixes - Removed duplicate attribute mapping where employee_id was emitted as both EMPLOYEE_NUMBER (Integer) and EMPLOYEE_ID (String)	• Device: LAST_USED_USER renamed to LAST_LOGIN_USER, MANUFACTURER remapped to standard attribute — Action: purge and re-sync • Device: Timestamp fields (BOOT_TIME) changed from Long to Instant — Action: purge and re-sync • User: LAST_LOGON renamed to LAST_LOGIN, CLOUD_PROVIDER remapped to standard attribute, EMPLOYEE_NUMBER removed (data now captured by EMPLOYEE_ID) — Action: purge and re-sync • User: Timestamp fields (LAST_LOGIN, LAST_PASSWORD_CHANGE, PASSWORD_EXPIRATION_DATE, USER_CREATED) changed from Long to Instant — Action: purge and re-sync
3.0.5	New Features - Added User custom properties and Device custom properties settings, letting you promote any Axonius custom property to a first-class attribute on synchronized Users and Devices by listing the property names (comma-delimited, case-insensitive).	N/A
3.0.4	New Features - Added the User asset model, so user accounts discovered by Axonius are now synchronized alongside Devices. Improvements - Consolidated overlapping device and user attributes onto Brinqa's standard attributes, eliminating duplicate values that were previously emitted under both the raw Axonius field name and the standard attribute name.	N/A
3.0.3	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.2	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.1	Improvements - Hostnames, MAC addresses, and serial numbers on Devices are now normalized during synchronization, improving consistency and matching of device records across data sources.	N/A
3.0.0	Overview The Axonius connector integrates with Axonius to synchronize asset inventory data into Brinqa. Category: Asset Management Models	N/A