Axonius

This integration is for fetching information about assets in Axonius.

Category

Data Enrichment & Threat Intelligence

Pack

Axonius

Configuration parameters

• ax_url — Server URL (e.g. https://example.net) (required)
• credentials — API Key (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (30)

• axonius-add-note — Add note to assets.
• axonius-add-tag — Add tag to assets.
• axonius-create-custom-data — Create a new custom data entry (POST /api/v2/custom_data_management).
• axonius-create-query — Create a new saved query (POST /api/v2/queries).
• axonius-delete-custom-data — Delete a custom data entry by ID (DELETE /api/v2/custom_data_management/{id}).
• axonius-delete-query — Delete a saved query (DELETE /api/v2/queries/{query_id}).
• axonius-get-asset-types — Return the list of all available asset types in the Axonius instance (GET /api/v2/assets/asset_types).
• axonius-get-assets — Fetch assets of any type using the Axonius v2 API (POST /api/v2/assets/{asset_type}). Supports all asset types including vulnerability_instances. Use next_token for pagination. Large responses (>10 MB) may be stored as a downloadable file by XSOAR instead of being written to the context. NOTE: All calls write to the fixed context key Axonius.Assets regardless of asset_type. If a playbook calls this command more than once with different asset types, each call overwrites the previous result. To avoid data loss, store or transform the context output (e.g. using Set) before issuing a second call with a different type.
• axonius-get-custom-data — List custom data management entries (GET /api/v2/custom_data_management).
• axonius-get-devices-by-aql — Gather devices info by AQL query.
• axonius-get-devices-by-hostname — Gather device info by hostname.
• axonius-get-devices-by-hostname-regex — Gather device info by hostname using regex.
• axonius-get-devices-by-ip — Gather device info by IP address.
• axonius-get-devices-by-ip-regex — Gather device info by IP address using regex.
• axonius-get-devices-by-mac — Gather device info by MAC address.
• axonius-get-devices-by-mac-regex — Gather device info by MAC address using regex.
• axonius-get-devices-by-savedquery — Gather device info by saved query.
• axonius-get-enforcements — List enforcement sets (GET /api/v2/enforcements).
• axonius-get-grouped-vulnerabilities — Fetch all vulnerability instances, flatten them, group by CVE ID, and return the Top N CVEs sorted by affected host count. Computes average_cvss_score per CVE. Outputs as Axonius.GroupedVulnerabilities keyed by cve_id.
• axonius-get-queries — List saved queries (GET /api/v2/queries).
• axonius-get-saved-queries — Get all saved query of a given asset type.
• axonius-get-tags — Get all tags of a given asset type.
• axonius-get-users-by-aql — Gather users info by AQL query.
• axonius-get-users-by-mail — Gather user info by email address.
• axonius-get-users-by-mail-regex — Gather user info by email address using regex.
• axonius-get-users-by-savedquery — Gather user info by saved query.
• axonius-get-users-by-username — Gather user info by username.
• axonius-get-users-by-username-regex — Gather user info by username using regex.
• axonius-remove-tag — Remove tag from assets.
• axonius-run-enforcement — Trigger an enforcement run (POST /api/v2/enforcements/{enforcement_id}/run).