> For the complete documentation index, see [llms.txt](https://docs.fusion.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fusion.vectra.ai/netofuse/security-considerations.md).

# Security Considerations

Overview NetoFuse has API access to Vectra Fusion to upload context labels and to the 3rd party product modules you are using to retrieve asset information. A threat actor that gains access to the sys

## Overview <a href="#overview" id="overview"></a>

NetoFuse has API access to Vectra Fusion to upload context labels and to the 3rd party product modules you are using to retrieve asset information. A threat actor that gains access to the system you deploy NetoFuse on in your environment could read these credentials, modify the NetoFuse code, or access these APIs directly. Therefore, it is important to implement the security concept of least privilege to reduce the risk of unauthorized access to this system.

## Best Practices <a href="#best-practices" id="best-practices"></a>

Here are recommended best practices to use in deploying netofuse in production environments:

* Use the NetoFuse container for deployment, as this is built on the Google distroless container image that significantly reduces the attack surface as compared to a default Linux distribution.
* If you choose to deploy NetoFuse as a Python package, deploy it on a dedicated system that adheres to your organization's security policies and is updated hardened, and all external services that are not strictly required are disabled (eg, no open ports or services except SSH). Limit network access to the system to authorized administrators only. Exercise general security best practices in operating a limited-use system of this type.
* Configure API keys for 3rd party modules with the least privilege needed to access the resources needed for the integration.
* Store API credentials in an external vault or secrets management system and pass credentials in at run-time rather than store the credentials locally. Choose the most secure credential storage approach for your environment.
* Regularly expire and rotate credentials being used.
* Enabling custom transforms loads arbitrary Python code you have defined in that file. This is disabled by default, can not be turned on from a configuration file, and requires using the command line option `--allow-custom-transforms`to turn on. Only enable this if you maintain strict control over that file and are thoroughly aware of the contents of the code.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.fusion.vectra.ai/netofuse/security-considerations.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.