Asset Fields Imported in File-Based Adapters
The following sections detail which fields are imported as common data fields for each asset file (Devices, Users, etc.). Any other data in the CSV/JSON/XML is exclusively adapter-specific data.
General guidelines
-
These fields apply to the general CSV adapter and the JSON and Custom Files adapters, according to the asset types fetched by each adapter. Any other asset-specific requirements are listed under the specific file type.
Note
In addition for the general CSV adapter, Axonius has several CSV Asset-Specific Adapters. Generally, these are no longer supported (see note in each page), but you can still use them for reference.
-
For all values under Accepted CSV Field Name(s), spaces, hyphens and underscores are ignored, and the field name is always lowercase. For example,
First_Name--> `firstname'. -
Fields marked as *KEY indicate that you need to include at least one of these fields as part of the imported CSV file. More *KEY fields available in the CSV file help provide stronger correlation.
Note about Security Findings fields
Security Findings are generated from the Security Findings complex field (table) within your assets. To import them, you must first import the corresponding assets (Devices, Users, etc.); then, map the Security Findings fields using the Adapter Custom Parsing capability, where you can define how to parse specific fields from the raw data fetched.
ific requirements are listed under the specific file type.
Note
In addition for the general CSV
Fields Imported with a Devices File
UI Field Name Accepted CSV/JSON Field Name(s) Notes Architecture architecture Asset Name name, vmname, displayname, assetname, machinename, instancename, samaccountname, endpointname, machine If no hostname is configured, the Asset Name value is used for the Host Name. Asset Tag assettag, tags, tag, labels, label Accepts multiple formats (see below) Cloud ID cloudid, linodeid Cloud Provider cloudprovider, cloudprovidor Device Manufacturer manufacturer, devicemanufacturer Device Manufacturer Serial serial, serialnumber, sn, hostserialnumber, deviceserialnumber, serial, endpointserialnumber, allserialnumbers *KEY Device Model model, modelid, endpointmodel Domain domain, domainname, endpointdomain If not specified and device is in DOMAIN\Name format, Axonius replaces the Domain with the parsed value. Host Name hostname, host, fqdn, fullyqualifieddomainname, compname, computername, servername, dnsname, hosthostname, endpointfqdn *KEY - Parses DOMAIN out if in DOMAIN\Name format. If set to "unknown", field is set to blank. ID id, identifier, serialnumber, assetid, resourceid *KEY - Combination of the "CSV File Name" and the specified field names. IPs ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, ipfirst Accepts a comma-separated set of IP addresses. Last Seen lastmessagetime, lastdiscoveredtime, lastseen, lastcheckin If not specified, uses the time the file was last imported. Last Used Users username Appends to existing list if the device already exists. MAC mac, macaddress, macaddresses, macs *KEY - Accepts a comma-separated set of MAC addresses. Machine name Network Interfaces networkinterfaces Axonius attempts to parse IP, MAC, and NICs from this field. OS os, osname, osversion, operatingsystem, osmode, uname, endpointos Parsed into multiple properties. Reach out to Axonius if an OS is not parsing as expected. OS: Kernel Version kernel, kernelversion Software Name packages Delimited by spaces. Tag Name tagname, tagkey, labelname, labelkey Tag Value tagvalue, labelvalue
Acceptable Formats for the Asset Tag Field
Format Example Comma-separated string "Production,Critical,Web"→ 3 tagsList of string ["Production", "Critical"]→ 2 tagsList of key-value dictionaries [{"key": "env", "value": "prod"}]→ 1 tag with keySingle dictionary {"key": "env", "value": "prod"}→ 1 tag with key
Fields Imported with a Users File
UI Field Name Accepted CSV Field Name(s) Notes Domain domain, domainname, endpointdomain First Name firstname, givenname ID id, identifier, serialnumber, assetid, resourceid, userid *KEY - The ID field is a combination of the "CSV File Name" value and the specified field names. Last Name lastname, surname, sn mail, email, usermail, mailaddress, email address, emailprimarywork, companyemail *KEY Name name, vmname, displayname, assetname, machinename, instancename, samaccountname, endpointname *KEY User Name username *KEY
Fields Imported with a Software Applications FileThe minimum requirements to parse Vulnerabilities from the CSV adapter are as follows:
- The File contains installed software parameter is checked.
- The file has at least the following headers:
- Hostname (or any of the headers supported as hostname)
- Software Name (header must be present, though may be empty on a row)
- CVE IDThe other headers (or data in a row for those headers) are optional for the purposes of parsing Vulnerabilities.
UI Field Name Accepted CSV Field Name(s) Notes Host Name hostname, host, fqdn, fullyqualifieddomainname, compname, computername, servername, dnsname, hosthostname, endpointfqdn *KEY - This field is required as the software list is imported to each individual device. Software Name softwarename, swname *KEY this field is required in order to parse installed software. This field may be left empty on a row with CVE ID. Software Path softwarepath, swpath Software Vendor softwarevendor, swvendor Software Version softwareversion, swversion CVE ID cve, cveid, cvelist, grypecve If present, a row featuring a CVE ID is parsed as vulnerable software in addition to installed software. CVE Description cvedescription This field will be ignored if CVE ID is empty or not present. CVE Severity cveseverity CVE Severity needs to be one of the values listed here. An invalid CVE Severity value is ignored. This field will be ignored if CVE ID is empty or not present. 'NONE', 'LOW', 'MEDIUM', 'MODERATE', 'SEVERE', 'SERIOUS', 'HIGH', 'CRITICAL', 'URGENT', 'INFO', 'UNTRIAGED', 'NEGLIGIBLE' CVE Status cvestatus CVE Status needs to be one of the values listed here. An invalid CVE Status value is ignored. This field will be ignored if CVE ID is empty or not present. 'open', 'closed', 'reopen', 'expired', 'done', 'valid', 'obsolete', 'pending'
Fields Imported with a Databases File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, serialnumber, assetid, recid, deviceid, objectid, hostid, databaseid *KEY - This field is required (database ID). Name name, displayname, assetname, instancename, databasename, datname, database, schemaname *KEY - This field is required (database name). IP ip, ipaddress, ipaddresses, ips, sourceip, ipaddresstext, paddresstext, primaryip, endpointipaddress, registerip, managementip, privateip, allips, ipfirst, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, databaseip Port port Status / Asset Status status, assetstatus, databasestatus, state Instance / Instance Type instance, instancetype Creation Date / Time creationdatetime, datecreation, createddatetime, creationtime
Fields Imported with an Accounts File
UI Field Name Accepted CSV Field Name(s) Notes ID id, identifier, serialnumber, assetid, recid, deviceid, objectid, hostid, accounteid *KEY - This field is required (account ID) Name name, diaplayname, assetname, instancename, accountename *KEY - This field is required (account name) Creation Time creationdatetime, datecreation
Fields Imported with a Business Applications File
UI Field Name Accepted CSV Field Name(s) Notes ID id, application number, applicationnumber *KEY - This field is required Name name, application name, applicationname *KEY - This field is required Application Type application type, applicationtype Application Description description, application description, applicationdescription Managed By managed by, managedby Business Criticality business critically, businesscritically Operational Status operational status, operationalstatus
Fields Imported with an Alerts/Incidents File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, incidentid, cloudid, uniqueid *KEY - This field is required Name name, incidentname, dusplayname Description created, createdtime, creationtime, creteddatetime, createdat Status status, incidentstatus, state Created At starttime, start Start Time starttime, start End Time endtime, end
Fields Imported with a Network Services File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid *KEY Name name, displayname *KEY Cloud ID cloudid, linodeid *KEY Cloud Provider cloudprovider, cloudprovidor Vendor vendor, provider, vendorname Asset Type instance, instancetype Description assettype, txtassettype, type Status status, incidentstatus, state Created created, creationdate, datecreation Last Seen lastmessagetime, lastdiscoveredtime, lastseen, lastcheckin IPs ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses, ipfirst This field accepts a comma separated set of IP addresses.
Fields Imported with a Certificates File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid, certificateid, certificateremoteid Key Name name, displayname, certificatename, commonname Key Cloud ID cloudid, linodeid Key Asset Type assettype, certificatetype, type One of: AWS Certificate, GoDaddy Certificate, Keyfactor Certificate, Webscan Certificate, Network Discovery Certificate, Cloudflare Certificate, CertificateFromKeyVault, ADCS Certificate, CSC DomainManager Certificate, Wiz Certificate, F5-IControl SSL Certificate Create Time createtime, created, createdtime, creationtime, createdatetime Issuer issuer, issuedby, certificateissuer Must be in DN (Distinguished Name) format Version version, certificateversion Serial Number serialnumber, serial, certificateserialnumber Key Subject subject, issuedto, certificatesubject Must be in DN (Distinguished Name) format Begins On beginson, validfrom, notbefore, startdate Expires On expireson, validto, notafter, expirationdate, expiration, expirationtime Bit Size bitsize, keysize, keylength Issued Distinguished Name issueddistinguishedname, distinguishedname, dn Status status, certificatestatus, state Key Algorithm keyalgorithm, keyalg, publickeyalgorithm Signature Algorithm signaturealgorithm, signaturealg, sigalgorithm Not Before notbefore, validfrom, beginson Imported At importedat, importtime, importedtime Cloud Provider cloudprovider, cloudprovidor Assigned IP Address ipaddresstext, ip, ipaddress, ipaddresses, ips, primaryip, endpointipaddress, registerip, sourceip, managementip, privateip, allips, ipfirst, lastip, address, ipaddresslist, ipaddri, ipaddrs, ipaddr, localip, privateipaddresses
Fields Imported with a Firewalls File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid, firewallid KEY Name name, displayname, firewallname KEY Original Source original_source, originalsource, presource, prenatsource Pre-NAT source IP/CIDR/range or 'any'. Supports the following formats:
Plain IP (10.0.0.5), CIDR (10.0.0.0/24), IP range (10.0.0.1-10.0.0.10), Any (anyor0.0.0.0/0)Translated Source translated_source, translatedsource, postsource, postnatsource, snatsource Post-NAT source IP/CIDR/range (SNAT). Supports same formats as Original Source Original Destination original_destination, originaldestination, predestination, prenatdestination Pre-NAT destination IP/CIDR/range or 'any'. Supports same formats as Original Source Translated Destination translated_destination, translateddestination, postdestination, postnatdestination, dnatdestination Post-NAT destination IP/CIDR/range (DNAT). Supports same formats as Original Source Original Port original_port, originalport, preport, prenatport Pre-NAT port: single port (e.g., 443) or port range (e.g.,80-443)Translated Port translated_port, translatedport, postport, postnatport Post-NAT port: single port or port range Protocols protocols, protocol A list of comma-separated protocols (TCP, UDP, ICMP, ANY) NAT Type nat_type, nattype, type Optional hint: SNAT / DNAT / NAT (automatically inferred if omitted) Is Static is_static, isstatic, static
Fields Imported with a Load Balancers File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid, loadbalancerid, lbid KEY Name name, displayname, loadbalancername, lbname KEY Host IPs host_ips, hostips, ipaddress, ip, loadbalancerip, lbip Accepts comma-separated values for multiple IP addresses Balanced IPs balanced_ips, balancedips, backendips, serverips, targetips Accepts comma-separated values for multiple IP addresses (balanced backend servers) Balanced Hostnames balanced_hostnames, balancedhostnames, backendhostnames, serverhostnames, targethostnames Accepts comma-separated values for multiple hostnames (balanced backend servers)
Fields Imported with a URLs/Domains File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid, urlid, domainid Key Base URL base_url, baseurl, url KEY - https://example.comDomain domain, domainname, hostname KEY - example.comIP Addresses ip_addresses, ipaddresses, ips, ip Accepts comma-separated IP addresses associated with the URL Destination Hostnames destination_hostnames, destinationhostnames, targethostnames, resolvedhostnames Accepts comma-separated destination hostnames the URL resolves to
Fields Imported with a Network Routes File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid, routeid, networkrouteid KEY Name name, displayname, routename, description KEY - route name or description Note
Additional routing-specific fields can be provided as needed for your network topology.
Fields Imported with a Containers File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid, assetid KEY Name name, displayname, assetname KEY
Fields Imported with an Application Settings File
UI Field Name Accepted CSV/JSON Field Name(s) Notes Setting Name setting_name KEY Vendor Name vendor_name KEY Setting Value setting_value KEY Is Valid is_valid KEY
Fields Imported with a Compute Services File
UI Field Name Accepted CSV/JSON Field Name(s) Notes ID id, identifier, uniqueid, cloudid Key - Either the ID, Name, or Cloud ID fields must be populated Name name, displayname, clustername, servicename Key - Either the ID, Name, or Cloud ID fields must be populated Cloud ID cloud_id, cloudid Key - Either the ID, Name, or Cloud ID fields must be populated Cloud Provider cloud_provider, cloudprovider Asset Type assettype, type Description description, details Status status, state Location location, region, zone
Fields Imported with a Tickets File
UI Field Name Accepted CSV/JSON Field Name(s) Notes Ticket ID ticket_id, ticketid, id, number, ticketnumber, incidentnumber KEY Summary summary, title, short_description, shortdescription Status status, state, ticketstatus Priority priority, ticketpriority, urgency Assignee assignee, assigned_to, assignedto Reporter reporter, created_by, createdby, opened_by Created created, createdat, creationtime, createddatetime Updated updated, updatedat, modifiedat, lastmodified
Additional Asset TypesNote
This section lists different asset-specific CSV adapters, which are generally no longer supported by Axonius; however, you can still refer to these pages to see the required table fields for each asset type.
For SaaS Applications see the structure in CSV - Applications
For DNS Records see the structure in CSV - DNS Records.
For Expenses see the structure in CSV - Expenses.
For Licenses see the structure in CSV - Licenses
For Networks see the structure in in CSV - Networks.
For Network Services see the structure in CSV - Network Services.
For URLs see the structures in CSV - URLs.
Updated 10 days ago
