Device Security
Nozomi Vantage Attribute Reference
Table of Contents
Expand All
|
Collapse All
Device Security Docs
Nozomi Vantage Attribute Reference
This reference lists the attributes that Device Security collects from Nozomi Vantage,
their names as stored in Device Security, and the Device Security device fields
they map to.
Device Security integrates with Nozomi Networks Vantage to enrich the device inventory
with OT and network visibility data. The attributes in this reference cover device
identification, network details, and vulnerability findings collected from the
Nozomi Vantage platform.
The third-party attribute name in Device Security refers to the attribute name
as it appears in the Assets Inventory table and in Query Engine. This follows the format
of third-party-name.attribute-name.
When viewing the attribute name in the Assets Inventory table column selector or on a
Device Details page, where the third-party name can be found as a header for the
attributes section, then the third-party name is removed from the attribute name.
For example, micrsoft_defender_xdr.macAddress would appear in the
Query Builder and in the Assets Inventory table, but under Device DetailsAttributesIntegration Specific AttributesMicrosoft Defender, the attribute would appear as macAddress.
Device Attributes
Device Security collects device attributes from the Nozomi Vantage API. The following table lists each Nozomi Vantage attribute, its name as stored in Device Security, and the Device Security device field it maps to (if applicable).
|
Nozomi Vantage Attribute
|
Device Security Attribute Name
|
Device Security Common Attribute*
|
Description
|
|---|---|---|---|
|
attributes._asset_kb_id
|
nozomi_vantage.attributes._asset_kb_id
|
—
|
Asset KB ID
|
|
attributes.appliance_hosts
|
nozomi_vantage.attributes.appliance_hosts
|
—
|
Appliance hosts
|
|
attributes.capture_device
|
nozomi_vantage.attributes.capture_device
|
—
|
Capture device
|
|
attributes.created_at
|
nozomi_vantage.attributes.created_at
|
—
|
Created at
|
|
attributes.device_id
|
nozomi_vantage.attributes.device_id
|
—
|
Device ID
|
|
attributes.end_of_sale_date
|
nozomi_vantage.attributes.end_of_sale_date
|
—
|
End of sale date
|
|
attributes.end_of_support_date
|
nozomi_vantage.attributes.end_of_support_date
|
—
|
End of support date
|
|
attributes.firmware_version
|
nozomi_vantage.attributes.firmware_version
|
latest_firmware_version
|
Firmware version
|
|
attributes.has_remediations
|
nozomi_vantage.attributes.has_remediations
|
—
|
Has remediations
|
|
attributes.has_replacement
|
nozomi_vantage.attributes.has_replacement
|
—
|
Has replacement
|
|
attributes.id
|
nozomi_vantage.attributes.id
|
—
|
ID
|
|
attributes.ip
|
nozomi_vantage.attributes.ip
|
—
|
IP address
|
|
attributes.ip.[0]
|
—
|
ipv4_address
|
IP address attribute collected from Nozomi Vantage
|
|
attributes.is_ai_enriched
|
nozomi_vantage.attributes.is_ai_enriched
|
—
|
Indicates whether the asset is AI enriched
|
|
attributes.is_arc_enriched
|
nozomi_vantage.attributes.is_arc_enriched
|
—
|
Indicates whether the asset is ARC enriched
|
|
attributes.is_sp_enriched
|
nozomi_vantage.attributes.is_sp_enriched
|
—
|
Indicates whether the asset is SP enriched
|
|
attributes.is_ti_enriched
|
nozomi_vantage.attributes.is_ti_enriched
|
—
|
Indicates whether the asset is TI enriched
|
|
attributes.last_activity_time
|
nozomi_vantage.attributes.last_activity_time
|
Last Third-Party Activity
|
Last activity time
|
|
attributes.latitude
|
nozomi_vantage.attributes.latitude
|
—
|
Latitude
|
|
attributes.level
|
nozomi_vantage.attributes.level
|
—
|
Level
|
|
attributes.lifecycle
|
nozomi_vantage.attributes.lifecycle
|
—
|
Lifecycle
|
|
attributes.location_source
|
nozomi_vantage.attributes.location_source
|
—
|
Location source
|
|
attributes.longitude
|
nozomi_vantage.attributes.longitude
|
—
|
Longitude
|
|
attributes.mac_address
|
nozomi_vantage.attributes.mac_address
|
MAC; id
|
MAC address
|
|
attributes.mobility
|
nozomi_vantage.attributes.mobility
|
—
|
Mobility
|
|
attributes.name
|
nozomi_vantage.attributes.name
|
Hostname
|
Name
|
|
attributes.nozomi_risk
|
nozomi_vantage.attributes.nozomi_risk
|
—
|
Nozomi risk
|
|
attributes.os
|
nozomi_vantage.attributes.os
|
raw_os
|
OS
|
|
attributes.os_or_firmware
|
nozomi_vantage.attributes.os_or_firmware
|
—
|
OS or firmware
|
|
attributes.product_name
|
nozomi_vantage.attributes.product_name
|
—
|
Product name
|
|
attributes.protocols
|
nozomi_vantage.attributes.protocols
|
—
|
Protocols
|
|
attributes.record_created_at
|
nozomi_vantage.attributes.record_created_at
|
—
|
Record created at
|
|
attributes.redundant_at
|
nozomi_vantage.attributes.redundant_at
|
—
|
Redundant at
|
|
attributes.replacement
|
nozomi_vantage.attributes.replacement
|
—
|
Replacement
|
|
attributes.replacement_url
|
nozomi_vantage.attributes.replacement_url
|
—
|
Replacement URL
|
|
attributes.risk
|
nozomi_vantage.attributes.risk
|
—
|
Risk
|
|
attributes.roles
|
nozomi_vantage.attributes.roles
|
—
|
Roles
|
|
attributes.serial_number
|
nozomi_vantage.attributes.serial_number
|
Serial Number
|
Serial number
|
|
attributes.software_inventory
|
—
|
third_party_learned_installed_software
|
Software inventory
|
|
attributes.technology_category
|
nozomi_vantage.attributes.technology_category
|
—
|
Technology category
|
|
attributes.time
|
nozomi_vantage.attributes.time
|
—
|
Time
|
|
attributes.type
|
nozomi_vantage.attributes.type
|
—
|
Type
|
|
attributes.updated_at
|
nozomi_vantage.attributes.updated_at
|
—
|
Updated at
|
|
attributes.vendor
|
nozomi_vantage.attributes.vendor
|
Vendor
|
Vendor
|
|
attributes.vendor_country
|
nozomi_vantage.attributes.vendor_country
|
—
|
Vendor country
|
|
attributes.vlan_id
|
nozomi_vantage.attributes.vlan_id
|
—
|
VLAN ID
|
|
attributes.zones
|
nozomi_vantage.attributes.zones
|
—
|
Zones
|
|
attributes.zones.[0]
|
—
|
Zone
|
Zones attribute collected from Nozomi Vantage
|
Vulnerability Attributes
Device Security collects vulnerability attributes from the Nozomi Vantage API. The following table lists each Nozomi Vantage vulnerability attribute, its name as stored in Device Security, and the Device Security vulnerability field it maps to (if applicable).
|
Nozomi Vantage Attribute
|
Device Security Attribute Name
|
Device Security Common Attribute*
|
Description
|
|---|---|---|---|
|
attributes.cve
|
nozomi_vantage.attributes.cve
|
cve
|
CVE
|
|
attributes.cwe_name
|
nozomi_vantage.attributes.cwe_name
|
—
|
CWE name
|
|
attributes.epss_score
|
nozomi_vantage.attributes.epss_score
|
—
|
EPSS score
|
|
attributes.mac_address
|
—
|
id
|
MAC address attribute collected from Nozomi Vantage
|
|
attributes.probability
|
nozomi_vantage.attributes.probability
|
—
|
Probability
|
|
attributes.resolved
|
—
|
state
|
Resolved attribute collected from Nozomi Vantage
|
|
attributes.score
|
nozomi_vantage.attributes.score
|
cvss_base_score
|
Score
|
|
attributes.time
|
—
|
detected_time
|
Time attribute collected from Nozomi Vantage
|
* Only some attributes map to a Device Security Common Attribute.