Asset Fields Imported in File-Based Adapters
The following sections detail which fields are imported as common data fields for each asset file (Devices, Users, etc.). Any other data in the CSV/JSON/XML is exclusively adapter-specific data.
General guidelines
-
These fields apply to the general CSV adapter and the JSON and Custom Files adapters, according to the asset types fetched by each adapter. Any other asset-specific requirements are listed under the specific file type.
Note
In addition for the general CSV adapter, Axonius has several CSV Asset-Specific Adapters.
-
For all values under Accepted CSV Field Name(s), spaces, hyphens and underscores are ignored, and the field name is always lowercase. For example,
First_Name--> `firstname'. -
Fields marked as *KEY indicate that you need to include at least one of these fields as part of the imported CSV file. More *KEY fields available in the CSV file help provide stronger correlation.
Fields Imported with a Devices File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| Architecture | architecture | |
| Asset Name | name, vmname, displayname, assetname, machinename, instancename, samaccountname, endpointname, machine | If no hostname is configured, the Asset Name value is used for the Host Name. |
| Asset Tag | assettag, tags, tag, labels, label | Accepts multiple formats (see below) |
| Cloud ID | cloudid, linodeid | |
| Cloud Provider | cloudprovider, cloudprovidor | |
| Device Manufacturer | manufacturer, devicemanufacturer | |
| Device Manufacturer Serial | serial, serialnumber, sn, hostserialnumber, deviceserialnumber, serial, endpointserialnumber, allserialnumbers | *KEY |
| Device Model | model, modelid, endpointmodel | |
| Domain | domain, domainname, endpointdomain | If not specified and device is in DOMAIN\Name format, Axonius replaces the Domain with the parsed value. |
| Host Name | hostname, host, fqdn, fullyqualifieddomainname, compname, computername, servername, dnsname, hosthostname, endpointfqdn | *KEY - Parses DOMAIN out if in DOMAIN\Name format. If set to "unknown", field is set to blank. |
| ID | id, identifier, serialnumber, assetid, resourceid | *KEY - Combination of the "CSV File Name" and the specified field names. |
| IPs | ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, ipfirst | Accepts a comma-separated set of IP addresses. |
| Last Seen | lastmessagetime, lastdiscoveredtime, lastseen, lastcheckin | If not specified, uses the time the file was last imported. |
| Last Used Users | username | Appends to existing list if the device already exists. |
| MAC | mac, macaddress, macaddresses, macs | *KEY - Accepts a comma-separated set of MAC addresses. |
| Machine | name | |
| Network Interfaces | networkinterfaces | Axonius attempts to parse IP, MAC, and NICs from this field. |
| OS | os, osname, osversion, operatingsystem, osmode, uname, endpointos | Parsed into multiple properties. Reach out to Axonius if an OS is not parsing as expected. |
| OS: Kernel Version | kernel, kernelversion | |
| Software Name | packages | Delimited by spaces. |
| Tag Name | tagname, tagkey, labelname, labelkey | |
| Tag Value | tagvalue, labelvalue |
Acceptable Formats for the Asset Tag Field
| Format | Example |
|---|---|
| Comma-separated string | "Production,Critical,Web" → 3 tags |
| List of string | ["Production", "Critical"] → 2 tags |
| List of key-value dictionaries | [{"key": "env", "value": "prod"}] → 1 tag with key |
| Single dictionary | {"key": "env", "value": "prod"} → 1 tag with key |
Fields Imported with a Users File
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| Domain | domain, domainname, endpointdomain | |
| First Name | firstname, givenname | |
| ID | id, identifier, serialnumber, assetid, resourceid, userid | *KEY - The ID field is a combination of the "CSV File Name" value and the specified field names. |
| Last Name | lastname, surname, sn | |
| mail, email, usermail, mailaddress, email address, emailprimarywork, companyemail | *KEY | |
| Name | name, vmname, displayname, assetname, machinename, instancename, samaccountname, endpointname | *KEY |
| User Name | username | *KEY |
Fields Imported with a Software Applications File
The minimum requirements to parse Vulnerabilities from the CSV adapter are as follows:
- The File contains installed software parameter is checked.
- The file has at least the following headers:
- Hostname (or any of the headers supported as hostname)
- Software Name (header must be present, though may be empty on a row)
- CVE ID
The other headers (or data in a row for those headers) are optional for the purposes of parsing Vulnerabilities.
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| Host Name | hostname, host, fqdn, fullyqualifieddomainname, compname, computername, servername, dnsname, hosthostname, endpointfqdn | *KEY - This field is required as the software list is imported to each individual device. |
| Software Name | softwarename, swname | *KEY this field is required in order to parse installed software. This field may be left empty on a row with CVE ID. |
| Software Path | softwarepath, swpath | |
| Software Vendor | softwarevendor, swvendor | |
| Software Version | softwareversion, swversion | |
| CVE ID | cve, cveid, cvelist, grypecve | If present, a row featuring a CVE ID is parsed as vulnerable software in addition to installed software. |
| CVE Description | cvedescription | This field will be ignored if CVE ID is empty or not present. |
| CVE Severity | cveseverity | CVE Severity needs to be one of the values listed here. An invalid CVE Severity value is ignored. This field will be ignored if CVE ID is empty or not present. 'NONE', 'LOW', 'MEDIUM', 'MODERATE', 'SEVERE', 'SERIOUS', 'HIGH', 'CRITICAL', 'URGENT', 'INFO', 'UNTRIAGED', 'NEGLIGIBLE' |
| CVE Status | cvestatus | CVE Status needs to be one of the values listed here. An invalid CVE Status value is ignored. This field will be ignored if CVE ID is empty or not present. 'open', 'closed', 'reopen', 'expired', 'done', 'valid', 'obsolete', 'pending' |
Fields Imported with a Databases File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, serialnumber, assetid, recid, deviceid, objectid, hostid, databaseid | *KEY - This field is required (database ID). |
| Name | name, displayname, assetname, instancename, databasename, datname, database, schemaname | *KEY - This field is required (database name). |
| IP | ip, ipaddress, ipaddresses, ips, sourceip, ipaddresstext, paddresstext, primaryip, endpointipaddress, registerip, managementip, privateip, allips, ipfirst, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, databaseip | |
| Port | port | |
| Status / Asset Status | status, assetstatus, databasestatus, state | |
| Instance / Instance Type | instance, instancetype | |
| Creation Date / Time | creationdatetime, datecreation, createddatetime, creationtime |
Fields Imported with an Accounts File
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, serialnumber, assetid, recid, deviceid, objectid, hostid, accounteid | *KEY - This field is required (account ID) |
| Name | name, diaplayname, assetname, instancename, accountename | *KEY - This field is required (account name) |
| Creation Time | creationdatetime, datecreation |
Fields Imported with a Business Applications File
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| ID | id, application number, applicationnumber | *KEY - This field is required |
| Name | name, application name, applicationname | *KEY - This field is required |
| Application Type | application type, applicationtype | |
| Application Description | description, application description, applicationdescription | |
| Managed By | managed by, managedby | |
| Business Criticality | business critically, businesscritically | |
| Operational Status | operational status, operationalstatus |
Fields Imported with an Alerts/Incidents File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, incidentid, cloudid, uniqueid | *KEY - This field is required |
| Name | name, incidentname, dusplayname | |
| Description | created, createdtime, creationtime, creteddatetime, createdat | |
| Status | status, incidentstatus, state | |
| Created At | starttime, start | |
| Start Time | starttime, start | |
| End Time | endtime, end |
Fields Imported with a Network Services File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid | *KEY |
| Name | name, displayname | *KEY |
| Cloud ID | cloudid, linodeid | *KEY |
| Cloud Provider | cloudprovider, cloudprovidor | |
| Vendor | vendor, provider, vendorname | |
| Asset Type | instance, instancetype | |
| Description | assettype, txtassettype, type | |
| Status | status, incidentstatus, state | |
| Created | created, creationdate, datecreation | |
| Last Seen | lastmessagetime, lastdiscoveredtime, lastseen, lastcheckin | |
| IPs | ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, ipfirst | This field accepts a comma separated set of IP addresses. |
Fields Imported with a Certificates File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, certificateid, certificateremoteid | Key |
| Name | name, displayname, certificatename, commonname | Key |
| Cloud ID | cloudid, linodeid | Key |
| Asset Type | assettype, certificatetype, type | One of: AWS Certificate, GoDaddy Certificate, Keyfactor Certificate, Webscan Certificate, Network Discovery Certificate, Cloudflare Certificate, CertificateFromKeyVault, ADCS Certificate, CSC DomainManager Certificate, Wiz Certificate, F5-IControl SSL Certificate |
| Create Time | createtime, created, createdtime, creationtime, createdatetime | |
| Issuer | issuer, issuedby, certificateissuer | Must be in DN (Distinguished Name) format |
| Version | version, certificateversion | |
| Serial Number | serialnumber, serial, certificateserialnumber | Key |
| Subject | subject, issuedto, certificatesubject | Must be in DN (Distinguished Name) format |
| Begins On | beginson, validfrom, notbefore, startdate | |
| Expires On | expireson, validto, notafter, expirationdate, expiration, expirationtime | |
| Bit Size | bitsize, keysize, keylength | |
| Issued Distinguished Name | issueddistinguishedname, distinguishedname, dn | |
| Status | status, certificatestatus, state | |
| Key Algorithm | keyalgorithm, keyalg, publickeyalgorithm | |
| Signature Algorithm | signaturealgorithm, signaturealg, sigalgorithm | |
| Not Before | notbefore, validfrom, beginson | |
| Imported At | importedat, importtime, importedtime | |
| Cloud Provider | cloudprovider, cloudprovidor | |
| Assigned IP Address | ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, ipfirst, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses |
Fields Imported with a Firewalls File
UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
ID | id, identifier, uniqueid, firewallid | KEY |
Name | name, displayname, firewallname | KEY |
Original Source | original_source, originalsource, presource, prenatsource | Pre-NAT source IP/CIDR/range or 'any'. Supports the following formats: |
Translated Source | translated_source, translatedsource, postsource, postnatsource, snatsource | Post-NAT source IP/CIDR/range (SNAT). Supports same formats as Original Source |
Original Destination | original_destination, originaldestination, predestination, prenatdestination | Pre-NAT destination IP/CIDR/range or 'any'. Supports same formats as Original Source |
Translated Destination | translated_destination, translateddestination, postdestination, postnatdestination, dnatdestination | Post-NAT destination IP/CIDR/range (DNAT). Supports same formats as Original Source |
Original Port | original_port, originalport, preport, prenatport | Pre-NAT port: single port (e.g., |
Translated Port | translated_port, translatedport, postport, postnatport | Post-NAT port: single port or port range |
Protocols | protocols, protocol | A list of comma-separated protocols (TCP, UDP, ICMP, ANY) |
NAT Type | nat_type, nattype, type | Optional hint: SNAT / DNAT / NAT (automatically inferred if omitted) |
Is Static | is_static, isstatic, static |
Fields Imported with a Load Balancers File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, loadbalancerid, lbid | KEY |
| Name | name, displayname, loadbalancername, lbname | KEY |
| Host IPs | host_ips, hostips, ipaddress, ip, loadbalancerip, lbip | Accepts comma-separated values for multiple IP addresses |
| Balanced IPs | balanced_ips, balancedips, backendips, serverips, targetips | Accepts comma-separated values for multiple IP addresses (balanced backend servers) |
| Balanced Hostnames | balanced_hostnames, balancedhostnames, backendhostnames, serverhostnames, targethostnames | Accepts comma-separated values for multiple hostnames (balanced backend servers) |
Fields Imported with a URLs/Domains File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, urlid, domainid | Key |
| Base URL | base_url, baseurl, url | KEY - https://example.com |
| Domain | domain, domainname, hostname | KEY - example.com |
| IP Addresses | ip_addresses, ipaddresses, ips, ip | Accepts comma-separated IP addresses associated with the URL |
| Destination Hostnames | destination_hostnames, destinationhostnames, targethostnames, resolvedhostnames | Accepts comma-separated destination hostnames the URL resolves to |
Fields Imported with a Network Routes File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, routeid, networkrouteid | KEY |
| Name | name, displayname, routename, description | KEY - route name or description |
Note
Additional routing-specific fields can be provided as needed for your network topology.
Fields Imported with a Containers File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, assetid | KEY |
| Name | name, displayname, assetname | KEY |
Updated 17 days ago