# Claroty

## About <a href="#about" id="about"></a>

The Claroty NetoFuse module provides enriched asset context to Netography Fusion from Claroty Industrial Cybersecurity appliances. It connects to the Claroty CTD/EMC API to retrieve asset information and then adds it as [Context Labels](/enrich-traffic-with-context/labels.md)in Netography Fusion.

{% hint style="info" %}
**☁️NetoFuse Modules: Cloud deployment vs. on-prem deployment**

This page documents how to add and configure the context integration in the Netography Fusion Portal. This will make a direct connection from the Netography Fusion SaaS in the cloud to the vendor API. If you prefer to deploy the integration within your own environment (on-prem or in your own cloud) with a container or Python package, go to the module documentation in [NetoFuse Modules](broken://pages/6i3otB8UAClHx08Umd0Y).
{% endhint %}

### Supported Products <a href="#supported-products" id="supported-products"></a>

#### Claroty Threat Detection (CTD) <a href="#claroty-threat-detection-ctd" id="claroty-threat-detection-ctd"></a>

#### Claroty Enterprise Management Console (EMC) <a href="#claroty-enterprise-management-console-emc" id="claroty-enterprise-management-console-emc"></a>

{% hint style="info" %}
**⚖️Integrate to Claroty EMC if you have deployed it, and Claroty CTD if not**

Claroty EMC aggregates data from multiple Claroty CTD appliances. Therefore, if you have deployed one or more Claroty EMCs in your environment, follow the configuration steps for each Claroty EMC appliance rather than each Claroty CTD.

The API and configuration steps are identical for both CTD and EMC appliances, so they are not differentiated in the documentation or in the `claroty` NetoFuse module.
{% endhint %}

## Configuring <a href="#configuring" id="configuring"></a>

All the fields required and optional for this integration are listed here.

| Field            | Required | Description                                                                                                                                                                                                                                                             |
| ---------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Claroty URL      | Yes      | URL used to access Claroty appliance                                                                                                                                                                                                                                    |
| Claroty Username | Yes      | Username to authenticate with                                                                                                                                                                                                                                           |
| Claroty Password | Yes      | Password to authenticate with                                                                                                                                                                                                                                           |
| Per Page         | Yes      | Number of results to return per page from Claroty API (default 5000)                                                                                                                                                                                                    |
| Fields           | Yes      | The fields to return from the Claroty API; If left blank, all asset fields are returned by the API, increasing the load on the Claroty appliance. You also must add fields to the Transform field in the Advanced section to map it to a Netography context label name. |

Consult the *Claroty Web API User Guide* for further assistance configuring these parameters, and use the *Claroty API Explorer* to experiment with parameters.

If you need to filter the list of assets returned by the Claroty API, additional parameters for configuration are available when using the [Claroty](/netofuse/modules/claroty.md) NetoFuse module on-prem. Netography Support can assist you if you want to add any of these parameters to a cloud deployment of this integration.

## Claroty CTD/EMC Configuration <a href="#claroty-ctdemc-configuration" id="claroty-ctdemc-configuration"></a>

### Create a read-only account in Claroty <a href="#create-a-read-only-account-in-claroty" id="create-a-read-only-account-in-claroty"></a>

1. Login to the Claroty CTD or EMC appliance.
2. Click the gear icon in the bottom left of screen.
3. Select User Management > Users and click `+` to add a user.
4. Add a user (e.g. `neto-api-user`) and save.
5. Go to User Management > Groups and click `+` to add a group.
6. Add a group (e.g., `Read Only API Group`), add the user you created.
7. Provide read permissions for the site(s) and assets as appropriate.

You can select more granular permissions for the group based on the data you want to be read from the system.

Consult the Claroty documentation if you encounter problems creating a user.

Use the account you just created, along with the URL to the appliance you created the account on, to configure the `claroty` NetoFuse module.

### Transform <a href="#transform" id="transform"></a>

The **Advanced** section of the context integration contains the *Transform* field. This field allows you to add, remove, or change the mapping of fields returned by the vendor API to Netography Fusion context labels.

See the [Context Transforms](/netofuse/context-transforms.md) documentation section for more instructions on editing this field.

It may be helpful to first configure all the parameters and the transform field with a [NetoFuse](/netofuse/about.md) container on your local system and then copy those fields into the Portal once you have validated that everything is configured properly.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/enrich-traffic-with-context/configure-context-integrations/claroty-context.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.