Integrations
Every system Connect talks to is set up as an account under Settings > Accounts: your cloud subscriptions, your on-prem enforcement points, and the IT systems you export to. This page lists all of them, says which ones need the on-prem Connector, and covers the setup steps they share. Each integration then has its own page.
Which integrations need the Connector
Connect reaches most systems directly from the cloud. The Connector is only involved when the target sits inside your network with no route in from the internet. The Type column on the Accounts page tells you which kind each account is: Cloud for a direct connection, On-Prem for one routed through a Connector (with a green or red dot for whether that Connector is connected right now).
| Integration | What it does | Connector | Setup |
|---|---|---|---|
| Amazon Web Services | Discovers resources into Inventory; forwards CloudTrail and Security Hub events | Not needed | AWS |
| Microsoft Azure | Discovers resources into Inventory; exports Connect Groups as Azure IP Groups | Not needed | Azure |
| Illumio | Discovers workloads into Inventory | Not needed | Illumio |
| SentinelOne | Discovers assets into Inventory | Not needed | SentinelOne |
| Guardicore | Discovers assets into Inventory; exports approved change requests as segmentation rules | Not needed | Guardicore |
| ServiceNow | Discovers CMDB records into Inventory; exports change requests and decommissioned assets | Not needed | ServiceNow |
| FireMon Security Manager | Discovers network objects and zones into Inventory | Not needed (uses your Insights registration) | Security Manager |
| Infoblox | Discovers networks into Inventory | Optional: select a Connector if your Grid Manager isn't reachable from the internet | Infoblox |
| Palo Alto Panorama | Exports Connect Groups as Dynamic Address Groups | Required | Panorama |
| VMware NSX | Exports Connect Groups as NSX Groups | Required | NSX |
The three Connector-based integrations are documented under Connector > Integrations, which also explains how to watch their jobs.
Two kinds of work
- Inventory discovery reads assets from a system and brings them into Inventory, where they sit alongside your cloud resources. You can search and filter them, and build Groups from them. Discovery is read-only: nothing is changed on the source system.
- Export pushes something out of Connect: a Group's IP addresses to an enforcement point (Azure, Panorama, NSX), an evaluated change request to a policy or ticketing system (Guardicore, ServiceNow), or a decommission match to a CMDB (ServiceNow).
An account can do both. ServiceNow and Guardicore accounts have Import and Export checkboxes on their Provision page, so you can enable one without the other.
Common to every integration
- Setup lives in one place. Add the account from Settings > Accounts, choosing the matching Cloud Provider. The Account ID field is labeled for the provider (AWS Account ID, Azure Subscription ID, Illumio Organization ID, and so on). Saving takes you to the Provision page, where the credentials go.
- Saving an account doesn't test it. The Provision page checks only that the required fields are filled in. Nothing contacts the system until the first discovery or export runs, so a wrong hostname or bad credentials shows up afterward, as a discovery error or a failed export, not as a form error. See Watching for problems.
- Passwords and tokens are never shown back to you. Every password, secret, and API token field is stored encrypted and write-only, so it's blank each time you open the Provision page. Every save needs it typed in again, even a save that only changes another field. Your other edits stay in the form; re-enter the secret and save again.
- Discovery runs on its own. The first discovery starts automatically as soon as an account is provisioned, and every account is re-discovered daily after that. Items that no longer exist in the source are removed by the next run that reads the source without errors.
- Least-privilege credentials. Each integration's page says what its account must be able to do. Discovery needs read access only; exports need write access to exactly the objects Connect creates.
Where to find what was discovered
| Where | What you see |
|---|---|
| Integrations (main navigation) | One row per integration: whether it's Active, how many Items it has contributed (click through to those items), and the Last Connection time |
| Inventory > Resources, filtered by Vendor | The individual items, with the integration shown as each item's Source |
| Groups > Group Candidates | The same items, matched by your Group's filters, so you can export them to Azure, Panorama, or NSX |
Watching for problems
Discovery problems surface in two places:
- Settings > Accounts shows "One or more of your accounts require attention." and a warning icon on the affected account.
- The account's Provision page shows a Resource Errors alert. Expand Error Details for the region, resource type, error message, and time of each failure. If the errors are about permissions, re-check the credentials; otherwise the message says what went wrong.
Errors clear on their own once a later discovery reads the same region without hitting them.
Export problems are reported where the export was configured: the History tab under Decommission for decommissioned-asset exports, and on the target system itself for change request and Group exports. See Troubleshooting.