Asset Fields Imported in File-Based Adapters
The following sections detail which fields are imported as common data fields for each asset file (Devices, Users, etc.). Any other data in the CSV/JSON/XML is exclusively adapter-specific data.
General guidelines
-
These fields apply to the general CSV adapter and the JSON and Custom Files adapters, according to the asset types fetched by each adapter. Any other asset-specific requirements are listed under the specific file type.
Note
In addition for the general CSV adapter, Axonius has several CSV Asset-Specific Adapters. Generally, these are no longer supported (see note in each page), but you can still use them for reference.
-
For all values under Accepted CSV Field Name(s), spaces, hyphens and underscores are ignored, and the field name is always lowercase. For example,
First_Name--> `firstname'. -
Fields marked as *KEY indicate that you need to include at least one of these fields as part of the imported CSV file. More *KEY fields available in the CSV file help provide stronger correlation.
Note about Security Findings fields
Security Findings are generated from the Security Findings complex field (table) within your assets. To import them, you must first import the corresponding assets (Devices, Users, etc.); then, map the Security Findings fields using the Adapter Custom Parsing capability, where you can define how to parse specific fields from the raw data fetched.
ific requirements are listed under the specific file type.
<Callout icon="📘" theme="info"> **Note** In addition for the general CSV
Fields Imported with a Devices File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| Architecture | architecture | |
| Asset Name | name, vmname, displayname, assetname, machinename, instancename, samaccountname, endpointname, machine | If no hostname is configured, the Asset Name value is used for the Host Name. |
| Asset Tag | assettag, tags, tag, labels, label | Accepts multiple formats (see below) |
| Cloud ID | cloudid, linodeid | |
| Cloud Provider | cloudprovider, cloudprovidor | |
| Device Manufacturer | manufacturer, devicemanufacturer | |
| Device Manufacturer Serial | serial, serialnumber, sn, hostserialnumber, deviceserialnumber, serial, endpointserialnumber, allserialnumbers | *KEY |
| Device Model | model, modelid, endpointmodel | |
| Domain | domain, domainname, endpointdomain | If not specified and device is in DOMAIN\Name format, Axonius replaces the Domain with the parsed value. |
| Host Name | hostname, host, fqdn, fullyqualifieddomainname, compname, computername, servername, dnsname, hosthostname, endpointfqdn | *KEY - Parses DOMAIN out if in DOMAIN\Name format. If set to "unknown", field is set to blank. |
| ID | id, identifier, serialnumber, assetid, resourceid | *KEY - Combination of the "CSV File Name" and the specified field names. |
| IPs | ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, ipfirst | Accepts a comma-separated set of IP addresses. |
| Last Seen | lastmessagetime, lastdiscoveredtime, lastseen, lastcheckin | If not specified, uses the time the file was last imported. |
| Last Used Users | username | Appends to existing list if the device already exists. |
| MAC | mac, macaddress, macaddresses, macs | *KEY - Accepts a comma-separated set of MAC addresses. |
| Machine | name | |
| Network Interfaces | networkinterfaces | Axonius attempts to parse IP, MAC, and NICs from this field. |
| OS | os, osname, osversion, operatingsystem, osmode, uname, endpointos | Parsed into multiple properties. Reach out to Axonius if an OS is not parsing as expected. |
| OS: Kernel Version | kernel, kernelversion | |
| Software Name | packages | Delimited by spaces. |
| Tag Name | tagname, tagkey, labelname, labelkey | |
| Tag Value | tagvalue, labelvalue |
Acceptable Formats for the Asset Tag Field
| Format | Example |
|---|---|
| Comma-separated string | "Production,Critical,Web" → 3 tags |
| List of string | ["Production", "Critical"] → 2 tags |
| List of key-value dictionaries | [{"key": "env", "value": "prod"}] → 1 tag with key |
| Single dictionary | {"key": "env", "value": "prod"} → 1 tag with key |
Fields Imported with a Users File
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| Domain | domain, domainname, endpointdomain | |
| First Name | firstname, givenname | |
| ID | id, identifier, serialnumber, assetid, resourceid, userid | *KEY - The ID field is a combination of the "CSV File Name" value and the specified field names. |
| Last Name | lastname, surname, sn | |
| mail, email, usermail, mailaddress, email address, emailprimarywork, companyemail | *KEY | |
| Name | name, vmname, displayname, assetname, machinename, instancename, samaccountname, endpointname | *KEY |
| User Name | username | *KEY |
Fields Imported with a Software Applications File
The minimum requirements to parse Vulnerabilities from the CSV adapter are as follows:
- The File contains installed software parameter is checked.
- The file has at least the following headers:
- Hostname (or any of the headers supported as hostname)
- Software Name (header must be present, though may be empty on a row)
- CVE ID
The other headers (or data in a row for those headers) are optional for the purposes of parsing Vulnerabilities.
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| Host Name | hostname, host, fqdn, fullyqualifieddomainname, compname, computername, servername, dnsname, hosthostname, endpointfqdn | *KEY - This field is required as the software list is imported to each individual device. |
| Software Name | softwarename, swname | *KEY this field is required in order to parse installed software. This field may be left empty on a row with CVE ID. |
| Software Path | softwarepath, swpath | |
| Software Vendor | softwarevendor, swvendor | |
| Software Version | softwareversion, swversion | |
| CVE ID | cve, cveid, cvelist, grypecve | If present, a row featuring a CVE ID is parsed as vulnerable software in addition to installed software. |
| CVE Description | cvedescription | This field will be ignored if CVE ID is empty or not present. |
| CVE Severity | cveseverity | CVE Severity needs to be one of the values listed here. An invalid CVE Severity value is ignored. This field will be ignored if CVE ID is empty or not present. 'NONE', 'LOW', 'MEDIUM', 'MODERATE', 'SEVERE', 'SERIOUS', 'HIGH', 'CRITICAL', 'URGENT', 'INFO', 'UNTRIAGED', 'NEGLIGIBLE' |
| CVE Status | cvestatus | CVE Status needs to be one of the values listed here. An invalid CVE Status value is ignored. This field will be ignored if CVE ID is empty or not present. 'open', 'closed', 'reopen', 'expired', 'done', 'valid', 'obsolete', 'pending' |
Fields Imported with a Databases File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, serialnumber, assetid, recid, deviceid, objectid, hostid, databaseid | *KEY - This field is required (database ID). |
| Name | name, displayname, assetname, instancename, databasename, datname, database, schemaname | *KEY - This field is required (database name). |
| IP | ip, ipaddress, ipaddresses, ips, sourceip, ipaddresstext, paddresstext, primaryip, endpointipaddress, registerip, managementip, privateip, allips, ipfirst, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, databaseip | |
| Port | port | |
| Status / Asset Status | status, assetstatus, databasestatus, state | |
| Instance / Instance Type | instance, instancetype | |
| Creation Date / Time | creationdatetime, datecreation, createddatetime, creationtime |
Fields Imported with an Accounts File
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, serialnumber, assetid, recid, deviceid, objectid, hostid, accounteid | *KEY - This field is required (account ID) |
| Name | name, diaplayname, assetname, instancename, accountename | *KEY - This field is required (account name) |
| Creation Time | creationdatetime, datecreation |
Fields Imported with a Business Applications File
| UI Field Name | Accepted CSV Field Name(s) | Notes |
|---|---|---|
| ID | id, application number, applicationnumber | *KEY - This field is required |
| Name | name, application name, applicationname | *KEY - This field is required |
| Application Type | application type, applicationtype | |
| Application Description | description, application description, applicationdescription | |
| Managed By | managed by, managedby | |
| Business Criticality | business critically, businesscritically | |
| Operational Status | operational status, operationalstatus |
Fields Imported with an Alerts/Incidents File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, incidentid, cloudid, uniqueid | *KEY - This field is required |
| Name | name, incidentname, dusplayname | |
| Description | created, createdtime, creationtime, creteddatetime, createdat | |
| Status | status, incidentstatus, state | |
| Created At | starttime, start | |
| Start Time | starttime, start | |
| End Time | endtime, end |
Fields Imported with a Network Services File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid | *KEY |
| Name | name, displayname | *KEY |
| Cloud ID | cloudid, linodeid | *KEY |
| Cloud Provider | cloudprovider, cloudprovidor | |
| Vendor | vendor, provider, vendorname | |
| Asset Type | instance, instancetype | |
| Description | assettype, txtassettype, type | |
| Status | status, incidentstatus, state | |
| Created | created, creationdate, datecreation | |
| Last Seen | lastmessagetime, lastdiscoveredtime, lastseen, lastcheckin | |
| IPs | ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, ipfirst | This field accepts a comma separated set of IP addresses. |
Fields Imported with a Certificates File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, certificateid, certificateremoteid | Key |
| Name | name, displayname, certificatename, commonname | Key |
| Cloud ID | cloudid, linodeid | Key |
| Asset Type | assettype, certificatetype, type | One of: AWS Certificate, GoDaddy Certificate, Keyfactor Certificate, Webscan Certificate, Network Discovery Certificate, Cloudflare Certificate, CertificateFromKeyVault, ADCS Certificate, CSC DomainManager Certificate, Wiz Certificate, F5-IControl SSL Certificate |
| Create Time | createtime, created, createdtime, creationtime, createdatetime | |
| Issuer | issuer, issuedby, certificateissuer | Must be in DN (Distinguished Name) format |
| Version | version, certificateversion | |
| Serial Number | serialnumber, serial, certificateserialnumber | Key |
| Subject | subject, issuedto, certificatesubject | Must be in DN (Distinguished Name) format |
| Begins On | beginson, validfrom, notbefore, startdate | |
| Expires On | expireson, validto, notafter, expirationdate, expiration, expirationtime | |
| Bit Size | bitsize, keysize, keylength | |
| Issued Distinguished Name | issueddistinguishedname, distinguishedname, dn | |
| Status | status, certificatestatus, state | |
| Key Algorithm | keyalgorithm, keyalg, publickeyalgorithm | |
| Signature Algorithm | signaturealgorithm, signaturealg, sigalgorithm | |
| Not Before | notbefore, validfrom, beginson | |
| Imported At | importedat, importtime, importedtime | |
| Cloud Provider | cloudprovider, cloudprovidor | |
| Assigned IP Address | ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, ipfirst, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses |
Fields Imported with a Firewalls File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, firewallid | KEY |
| Name | name, displayname, firewallname | KEY |
| Original Source | original_source, originalsource, presource, prenatsource | Pre-NAT source IP/CIDR/range or 'any'. Supports the following formats: Plain IP ( 10.0.0.5), CIDR (10.0.0.0/24), IP range (10.0.0.1-10.0.0.10), Any (any or 0.0.0.0/0) |
| Translated Source | translated_source, translatedsource, postsource, postnatsource, snatsource | Post-NAT source IP/CIDR/range (SNAT). Supports same formats as Original Source |
| Original Destination | original_destination, originaldestination, predestination, prenatdestination | Pre-NAT destination IP/CIDR/range or 'any'. Supports same formats as Original Source |
| Translated Destination | translated_destination, translateddestination, postdestination, postnatdestination, dnatdestination | Post-NAT destination IP/CIDR/range (DNAT). Supports same formats as Original Source |
| Original Port | original_port, originalport, preport, prenatport | Pre-NAT port: single port (e.g., 443) or port range (e.g., 80-443) |
| Translated Port | translated_port, translatedport, postport, postnatport | Post-NAT port: single port or port range |
| Protocols | protocols, protocol | A list of comma-separated protocols (TCP, UDP, ICMP, ANY) |
| NAT Type | nat_type, nattype, type | Optional hint: SNAT / DNAT / NAT (automatically inferred if omitted) |
| Is Static | is_static, isstatic, static |
Fields Imported with a Load Balancers File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, loadbalancerid, lbid | KEY |
| Name | name, displayname, loadbalancername, lbname | KEY |
| Host IPs | host_ips, hostips, ipaddress, ip, loadbalancerip, lbip | Accepts comma-separated values for multiple IP addresses |
| Balanced IPs | balanced_ips, balancedips, backendips, serverips, targetips | Accepts comma-separated values for multiple IP addresses (balanced backend servers) |
| Balanced Hostnames | balanced_hostnames, balancedhostnames, backendhostnames, serverhostnames, targethostnames | Accepts comma-separated values for multiple hostnames (balanced backend servers) |
Fields Imported with a URLs/Domains File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, urlid, domainid | Key |
| Base URL | base_url, baseurl, url | KEY - https://example.com |
| Domain | domain, domainname, hostname | KEY - example.com |
| IP Addresses | ip_addresses, ipaddresses, ips, ip | Accepts comma-separated IP addresses associated with the URL |
| Destination Hostnames | destination_hostnames, destinationhostnames, targethostnames, resolvedhostnames | Accepts comma-separated destination hostnames the URL resolves to |
Fields Imported with a Network Routes File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, routeid, networkrouteid | KEY |
| Name | name, displayname, routename, description | KEY - route name or description |
Note
Additional routing-specific fields can be provided as needed for your network topology.
Fields Imported with a Containers File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, assetid | KEY |
| Name | name, displayname, assetname | KEY |
Fields Imported with an Application Settings File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| Setting Name | setting_name | KEY |
| Vendor Name | vendor_name | KEY |
| Setting Value | setting_value | KEY |
| Is Valid | is_valid | KEY |
Fields Imported with a Compute Services File
| UI Field Name | Accepted CSV/JSON Field Name(s) | Notes |
|---|---|---|
| ID | id, identifier, uniqueid, cloudid | Key - Either the ID, Name, or Cloud ID fields must be populated |
| Name | name, displayname, clustername, servicename | Key - Either the ID, Name, or Cloud ID fields must be populated |
| Cloud ID | cloud_id, cloudid | Key - Either the ID, Name, or Cloud ID fields must be populated |
| Cloud Provider | cloud_provider, cloudprovider | |
| Asset Type | assettype, type | |
| Description | description, details | |
| Status | status, state | |
| Location | location, region, zone |
Additional Asset Types
Note
This section lists different asset-specific CSV adapters, which are generally no longer supported by Axonius; however, you can still refer to these pages to see the required table fields for each asset type.
For SaaS Applications see the structure in CSV - Applications
For DNS Records see the structure in CSV - DNS Records.
For Expenses see the structure in CSV - Expenses.
For Licenses see the structure in CSV - Licenses
For Networks see the structure in in CSV - Networks.
For Network Services see the structure in CSV - Network Services.
For URLs see the structures in CSV - URLs.
Updated about 11 hours ago
Did this page help you?