# Axonius

## About <a href="#about" id="about"></a>

The Axonius NetoFuse module provides enriched asset context to Netography Fusion from Axonius. It connects to the Axonius Platform API to retrieve asset information and then uploads it as [Context Labels](/enrich-traffic-with-context/labels.md) to the Netography Fusion API.

As Axonius is a flexible platform that has a very broad set of potential queries and fields that may be used, you should expect that using this module will require basic familiarity with Axonius.

{% hint style="info" %}
**☁️NetoFuse Modules: Cloud deployment vs. On-Prem deployment**

This page documents how to add and configure the NetoFuse module for an on-prem deployment with a container or Python package. If you want to use the cloud deployment model and have this integration run in the Netography Fusion SaaS, you can add it as a context integration in the Netography Fusion Portal instead by consulting the [Context Integrations](/enrich-traffic-with-context/configure-context-integrations.md) documentation.
{% endhint %}

## API Configuration Parameters <a href="#api-configuration-parameters" id="api-configuration-parameters"></a>

All the fields required for this integration are listed here, along with the corresponding environment variable name used to set that field in the NetoFuse module.

| Axonius Field | Required | NetoFuse Environment Variable       | Description                                           |
| ------------- | -------- | ----------------------------------- | ----------------------------------------------------- |
| URL           | yes      | `NETO__AXONIUS__URL`                | URL to Axonius API                                    |
| API Key       | yes      | `NETO__AXONIUS_CREDENTIALS__KEY`    | Authentication key for Axonius API                    |
| API Secret    | yes      | `NETO__AXONIUS_CREDENTIALS__SECRET` | Authentication secret for Axonius API                 |
| `saved_query` | no       | `NETO__AXONIUS__SAVED_QUERY`        | Saved query can be used to retrieve asset information |

## Axonius Configuration <a href="#axonius-configuration" id="axonius-configuration"></a>

1. Create an API key in Axonius by following the instructions here: [Axonius REST API](https://docs.axonius.com/docs/axonius-rest-api)
2. Optional: You can create a Saved Query in Axonius and then use that to determine what asset information is retrieved from the Axonius API. See: [Creating and Saving a Saved Query in Axonius](https://docs.axonius.com/docs/saved-queries-devices). If you do not specify a saved query, you must instead directly define the query in the Axonius NetoFuse module configuration below.

### Configuring how the Axonius API is queried <a href="#configuring-how-the-axonius-api-is-queried" id="configuring-how-the-axonius-api-is-queried"></a>

Due to the wide variety in how Axonius is used, the `axonius` NetoFuse module does not have a default configuration for what assets and fields to use from Axonius. At a minimum, you must define the query to use with Axonius and the fields to retrieve.

The `axonius` module has three options available for defining what assets are retrieved and what fields are retrieved for those assets:

#### API query option 1: `saved_query` <a href="#api-query-option-1-saved_query" id="api-query-option-1-saved_query"></a>

See step 2 of the Axonius Configuration section above to set a saved query in Axonius.

#### API query option 2: `query` and `fields` <a href="#api-query-option-2-query-and-fields" id="api-query-option-2-query-and-fields"></a>

Use the `query` field with a valid Axonius GUI wizard expression. See [Creating Queries with the Query Wizard](https://docs.axonius.com/docs/query-wizard-and-query-filter) for instructions on constructing queries in the Axonius GUI.

The `fields` field contains the list of Axonius fields to return from the API. To see a list of available fields in your Axonius deployment, you can install the Axonius API client and run the following command:

`axonshell devices get-fields`

#### API query option 3: `entries` and `fields` <a href="#api-query-option-3-entries-and-fields" id="api-query-option-3-entries-and-fields"></a>

The `entries` field contains the Axonius API wizard expression used to return the list of devices. You can get help with this by installing the Axonius API client and running the following command:

`axonshell devices get --help-detailed wizard`

The `fields` field contains the list of Axonius fields to return from the API. To see a list of available fields in your Axonius deployment, you can install the Axonius API client and run the following command:

`axonshell devices get-fields`

#### `client_args` adds additional arguments to pass to the Axonius API client <a href="#client_args-adds-additional-arguments-to-pass-to-the-axonius-api-client" id="client_args-adds-additional-arguments-to-pass-to-the-axonius-api-client"></a>

Any `key:value` parameters included in the `client_args:`section of the module configuration will be directly passed as parameters to the Axonius API client.

#### Tips for configuring queries <a href="#tips-for-configuring-queries" id="tips-for-configuring-queries"></a>

The module uses the Axonius API client to connect to and retrieve assets from Axonius. This is a freely available client from Axonius, and it is very helpful to have this client installed and configured on your development or local system if you will use this module. Test the queries and field settings you want to use, and inspect the results that are being returned using the `axonshell devices` commands.

For example, this command can be used as a template for testing different field and query configuration options:

`axonshell devices get --fields '' --query ''`

Download the Axonius API client here: <https://axonius-api-client.readthedocs.io/en/latest/index.html>

### default `axonius` module configuration <a href="#default-axonius-module-configuration" id="default-axonius-module-configuration"></a>

{% tabs %}
{% tab title="YAML" %}

```
  axonius:
    url:
    saved_query: Netography API Query 1
    client_args: {}
    credentials:
      key:
      secret:
    transform:
      specific_data.data.hostname:
        context: name
      specific_data.data.network_interfaces.ips:
        context: ip
      specific_data.data.network_interfaces.mac:
        context: mac_addr
      specific_data.data.os.type:
        context: os
        function:
          function: transform_os
      specific_data.data.os.os_str:
        context: osver
      specific_data.data.cpus.manufacturer:
        context: manufacturer
```

{% endtab %}
{% endtabs %}

### `axonius` NetoFuse Context Transform <a href="#axonius-netofuse-context-transform" id="axonius-netofuse-context-transform"></a>

Use the [buildtransform command](/netofuse/shell-commands.md#buildtransform) to build a new transform configuration based on the actual fields returned by the Axonius API.

You can edit the transform section to change the context values to the context label names to use in Netography and remove any extra fields returned by Axonius that you do not want to be loaded. See the [Context Transforms](/netofuse/context-transforms.md) documentation section for more instructions on building and editing NetoFuse transforms.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/netofuse/modules/axonius.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.