Nozomi Networks Guardian

OT Security

Overview

The Nozomi Networks Guardian connector integrates with a Nozomi Networks Guardian appliance through its Open API query endpoint. It synchronizes the OT asset inventory (assets, network nodes, and the hardware and software products identified on them) together with the CVE vulnerabilities Guardian matches to each node and their definitions, including any Guardian custom fields defined on assets and nodes.

Data retrieved from Nozomi Networks Guardian

Connector Object	Required	Maps to Data Model
Asset	Yes	Device
Node	Yes	Host
Product	Yes	Package
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Nozomi Networks Guardian in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Nozomi Networks Guardian from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	—	Guardian server URL
Username	Yes	—	Guardian account username
Password	Yes	—	Guardian account password
Page size	No	100	Maximum number of records to get per API request
Parallel requests	No	min(4, available processors)	Maximum number of parallel API requests
Max retries	No	5	Maximum number of retry attempts before giving up a request
SSL / TLS	Yes	false	Skip certificate verification

Authentication

Method

HTTP Basic authentication with a Guardian account username and password.

Endpoint

Method	URL
GET	https://<guardian-server>/api/open/query/do

Request Headers

Header	Value
Authorization	Basic <base64(username:password)>

Request Body

The query endpoint is a GET request without a body; the query is passed as URL parameters. The connectivity test runs the request below to validate the credentials:

GET /api/open/query/do?query=assets&count=1&page=1

Sample Response

{
  "result": [
    {
      "name": "PLC-01",
      "type": "PLC",
      "ip": [
        "10.0.0.10"
      ]
    }
  ],
  "header": [
    "name",
    "type",
    "ip"
  ],
  "total": 1
}

Response Fields

Field	Type	Description
result	Array	The rows of the requested query page
header	Array	The column names of the query
total	Integer	The number of rows returned
error	String	Present instead of result when the request fails (for example Unauthorized)

Usage

The credentials are sent on every request with HTTP Basic authentication. The SSL / TLS configuration option skips server certificate verification, for Guardian appliances that use a self-signed certificate.

All models are read from the same query endpoint, paging with the page (1-based) and count parameters:

Parameter	Description
query	The Guardian query, e.g. nodes or node_cves with optional | where ... filters
count	The page size (the pageSize configuration property)
page	The page number; pages are requested in parallel batches of parallelismLevel until a page returns fewer than count rows

---

Sync Behavior

All models support incremental syncs; the first sync, or a sync without a token, fetches every record. For nodes, vulnerabilities, and vulnerability definitions the sync token is converted into a where days_ago/hours_ago/minutes_ago/seconds_ago(<field>) <= N filter on the Guardian query. For assets and products it is compared directly with the field, as Guardian time fields are epoch milliseconds: where <field> > <sync token>. Either way, only records active since the previous sync are returned. The field filtered on is documented under each model's Sync Duration Parameter.

How to obtain Nozomi Networks Guardian credentials

Obtain the required credentials (url, username, password, devMode) from your Nozomi Networks Guardian administrator or the Nozomi Networks Guardian admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Asset

Source Field Name	SDM Attribute
AssetResource.appliance_hosts	APPLIANCE_HOSTS
AssetResource.capture_device	CAPTURE_DEVICE
AssetResource.custom_fields	<CUSTOM_FIELD>
AssetResource.firmware_version	FIRMWARE_VERSION
AssetResource.ip	IP_ADDRESSES
AssetResource.level	LEVEL
AssetResource.mac_address	MAC_ADDRESSES
AssetResource.mac_address_level	MAC_ADDRESS_LEVELS
AssetResource.mac_vendor	MAC_VENDOR
AssetResource.name (fallback: UID)	NAME
AssetResource.nodes	NODES
AssetResource.os	OS
AssetResource.os_or_firmware	OS_OR_FIRMWARE
AssetResource.product_name	PRODUCT_NAME
AssetResource.protocols	PROTOCOLS
AssetResource.roles	ROLES
AssetResource.serial_number	SERIAL_NUMBER
AssetResource.serial_number (fallback: AssetResource.name)	UID
AssetResource.type	ASSET_TYPE
AssetResource.vendor	VENDOR
AssetResource.vlan_id	VLAN_ID
AssetResource.zones	ZONES
constant	CATEGORIES
constant	STATUS
sync timestamp	LAST_CAPTURED

Node

Source Field Name	SDM Attribute
constant	CATEGORIES
constant	STATUS
NodeResource._asset_kb_id	ASSET_KB_ID
NodeResource._is_licensed	IS_LICENSED
NodeResource._private_status	PRIVATE_STATUS
NodeResource.appliance_host	APPLIANCE_HOST
NodeResource.bpf_filter	BPF_FILTER
NodeResource.capture_device	CAPTURE_DEVICE
NodeResource.created_at	SOURCE_CREATED_DATE
NodeResource.custom_fields	<CUSTOM_FIELD>
NodeResource.device_id	DEVICE_ID
NodeResource.firmware_version	FIRMWARE_VERSION
NodeResource.first_activity_time	FIRST_SEEN
NodeResource.id	UID
NodeResource.ip	IP_ADDRESSES
NodeResource.is_broadcast	IS_BROADCAST
NodeResource.is_confirmed	IS_CONFIRMED
NodeResource.is_disabled	IS_DISABLED
NodeResource.is_fully_learned	IS_FULLY_LEARNED
NodeResource.is_learned	IS_LEARNED
NodeResource.is_public	IS_PUBLIC
NodeResource.label	LABEL
NodeResource.label (fallback: NodeResource.id)	NAME
NodeResource.last_activity_time	LAST_SEEN
NodeResource.level	LEVEL
NodeResource.mac_address	MAC_ADDRESSES
NodeResource.mac_vendor	MAC_VENDOR
NodeResource.os	OS
NodeResource.product_name	PRODUCT_NAME
NodeResource.protocols	PROTOCOLS
NodeResource.received.bytes	RECEIVED_BYTES
NodeResource.received.last_15m_bytes	RECEIVED_LAST_15M_BYTES
NodeResource.received.last_30m_bytes	RECEIVED_LAST_30M_BYTES
NodeResource.received.last_5m_bytes	RECEIVED_LAST_5M_BYTES
NodeResource.received.packets	RECEIVED_PACKETS
NodeResource.reputation	REPUTATION
NodeResource.roles	ROLES
NodeResource.sent.bytes	SENT_BYTES
NodeResource.sent.last_15m_bytes	SENT_LAST_15M_BYTES
NodeResource.sent.last_30m_bytes	SENT_LAST_30M_BYTES
NodeResource.sent.last_5m_bytes	SENT_LAST_5M_BYTES
NodeResource.sent.packets	SENT_PACKETS
NodeResource.serial_number	SERIAL_NUMBER
NodeResource.subnet	SUBNET
NodeResource.type	NODE_TYPE
NodeResource.variables_count	VARIABLES_COUNT
NodeResource.vendor	VENDOR
NodeResource.vlan_id	VLAN_ID
NodeResource.zone	ZONE
sync timestamp	LAST_CAPTURED

Product

Source Field Name	SDM Attribute
constant	CATEGORIES
constant	STATUS
CpeResource.cpe	UID
CpeResource.cpe	CPE_RECORDS
CpeResource.cpe_translator (fallback: CpeResource.cpe_part)	PART
CpeResource.human_cpe_edition (fallback: CpeResource.cpe_edition)	EDITION
CpeResource.human_cpe_product (fallback: CpeResource.cpe_product)	NAME
CpeResource.human_cpe_update (fallback: CpeResource.cpe_update)	UPDATE
CpeResource.human_cpe_vendor (fallback: CpeResource.cpe_vendor)	VENDOR
CpeResource.human_cpe_version (fallback: CpeResource.cpe_version)	REVISION
CpeResource.likelihood	LIKELIHOOD
CpeResource.replicated	REPLICATED
CpeResource.synchronized	SYNCHRONIZED
CpeResource.updated	UPDATED
sync timestamp	LAST_CAPTURED

Vulnerability

Source Field Name	SDM Attribute
CveResource.appliance_host	APPLIANCE_HOST
CveResource.appliance_id	APPLIANCE_ID
CveResource.appliance_ip	APPLIANCE_IP
CveResource.cve	TYPE
CveResource.cve	CVE_IDS
CveResource.cve	CVE_RECORDS
CveResource.cve (fallback: CveResource.id)	NAME
CveResource.cve_creation_time	PUBLISHED_DATE
CveResource.cve_references[].name	REFERENCE_NAMES
CveResource.cve_references[].reference_type	REFERENCE_TYPES
CveResource.cve_references[].source	REFERENCE_SOURCES
CveResource.cve_references[].url	REFERENCES
CveResource.cve_score	CVSS_SCORE
CveResource.cve_summary	DESCRIPTION
CveResource.cve_update_time	SOURCE_LAST_MODIFIED
CveResource.cwe_id	CWE_IDS
CveResource.cwe_id	WEAKNESSES
CveResource.id	UID
CveResource.installed_on	INSTALLED_ON
CveResource.likelihood	LIKELIHOOD
CveResource.matching_cpes	CPE_RECORDS
CveResource.node_id	TARGETS
CveResource.resolved	PROVIDER_STATUS
CveResource.resolved	RESOLVED
CveResource.resolved_reason	RESOLVED_REASON
CveResource.resolved_source	RESOLVED_SOURCE
CveResource.time	LAST_FOUND
CveResource.zone	ZONE
derived from PROVIDER_STATUS	SOURCE_STATUS
derived from PROVIDER_STATUS	STATUS
sync timestamp	LAST_CAPTURED

Vulnerability Definition

Source Field Name	SDM Attribute
CveResource.cve	UID
CveResource.cve	NAME
CveResource.cve	CVE_IDS
CveResource.cve	CVE_RECORDS
CveResource.cve_creation_time	PUBLISHED_DATE
CveResource.cve_references[].name	REFERENCE_NAMES
CveResource.cve_references[].reference_type	REFERENCE_TYPES
CveResource.cve_references[].source	REFERENCE_SOURCES
CveResource.cve_references[].url	REFERENCES
CveResource.cve_score	SOURCE_SEVERITY
CveResource.cve_score	SOURCE_SEVERITY_SCORE
CveResource.cve_summary	DESCRIPTION
CveResource.cve_update_time	SOURCE_LAST_MODIFIED
CveResource.cwe_id	CWE_IDS
CveResource.cwe_id	WEAKNESSES
CveResource.cwe_name	CATEGORIES
CveResource.matching_cpes	TAGS
derived from CveResource.cve_score	SEVERITY
derived from SEVERITY	SEVERITY_SCORE
sync timestamp	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Asset

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_activity_time.

API

• Type: REST endpoint · Endpoint: GET /api/open/query/do
• Default filters: rows whose name and serial number are both blank are skipped

note

• Guardian custom fields are discovered when the schema is built, by sampling the first rows of the query. Each custom field becomes a String attribute named __<FIELD NAME>__ (upper-cased, whitespace replaced with _) and titled *__<FIELD NAME>__; a field whose sampled value is a list is multi-valued. Custom fields named Name or Uid keep their original name. Values are mapped as returned by Guardian.

---

Node

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_activity_time.

API

• Type: REST endpoint · Endpoint: GET /api/open/query/do
• Default filters: rows with a blank ID are skipped

note

• Guardian custom fields are discovered and mapped as described for the Asset model.

---

Product

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on time.

API

• Type: REST endpoint · Endpoint: GET /api/open/query/do
• Default filters: rows without a CPE are skipped

Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on time.

API

• Type: REST endpoint · Endpoint: GET /api/open/query/do
• Default filters: none

note

• The node_cves rows are cached in a local store keyed by the sync's transaction ID, so the Vulnerability and Vulnerability Definition models of the same transaction query Guardian only once: a model that finds rows already stored for its transaction replays them instead of querying Guardian, whatever its own sync window. Syncs without a transaction ID share a single default store.

---

Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on time.

API

• Type: REST endpoint · Endpoint: GET /api/open/query/do
• Default filters: rows without a CVE are skipped; rows are de-duplicated by CVE

note

• Guardian has no dedicated CVE endpoint, so definitions are derived from the node_cves rows and de-duplicated by CVE; the first row seen for a CVE provides the definition attributes. De-duplication uses a temporary local store that is deleted when the sync ends.
• The node_cves rows are cached in a local store keyed by the sync's transaction ID, so the Vulnerability and Vulnerability Definition models of the same transaction query Guardian only once: a model that finds rows already stored for its transaction replays them instead of querying Guardian, whatever its own sync window. Syncs without a transaction ID share a single default store.

---

Changelog

Changelog

The Nozomi Networks Guardian connector has undergone the following changes:

Version	Description	Migration Steps
3.0.0	Overview The Nozomi Networks Guardian connector integrates with Nozomi Networks Guardian to synchronize the OT asset inventory — assets, network nodes, and the hardware and software products identified on them — along with the CVE vulnerabilities Guardian matches to each node and their definitions. Category: OT Security Models	N/A