Security Manager: Inventory Discovery
The Security Manager integration brings objects from your on-prem FireMon Security Manager into Connect's Inventory, where they sit alongside your cloud resources:
- Network Objects: the address objects defined on each device (hosts, groups, subnets, ranges), with their addresses and, where Security Manager has them, hit counts and last-used times
- Zones: each device's security zones, with the IP addresses of the interfaces in the zone
It authenticates through the connection your Security Manager already holds open to FireMon Insights. This integration only reads; nothing is written back to Security Manager.
Before you start
| Prerequisite | Why it's needed | Where to check |
|---|---|---|
| Security Manager registered with FireMon Insights | Connect reaches Security Manager only through the Insights connection | In Security Manager, Administration > Settings > Insights shows Registration Details when registered. See Connect Your SIP Instance |
Outbound HTTPS from the Security Manager application server to insights.prod.firemon.cloud and ws.insights.prod.firemon.cloud | Registration uses the first; discovery runs over the persistent connection to the second | Insights prerequisites |
| The Security Manager provider enabled for your Connect client | It's hidden in the Cloud Provider list by default | If you don't see it, ask FireMon Support to enable it |
One Connect client can hold one Security Manager registration. If you run several independent Security Manager installations, each needs its own Connect client.
Set up a Security Manager account
- In Connect, go to Settings > Accounts and add a new account.
- Cloud Provider: Security Manager. Give it an Account ID (any identifier that's unique among your accounts; the Security Manager hostname works well), a name, and a project.
- Save. The account is provisioned immediately and the first discovery starts on its own.
You can create the account before registering with Insights, but discovery fails until the registration exists. Register with Insights first to avoid a failed run.
What gets discovered
Discovery walks every device in Security Manager's default domain and creates:
| Item type | One per | Name | IPs |
|---|---|---|---|
| Network Object | network object on a device | The object's display name | The object's addresses, flattened |
| Zone | zone on a device | The zone's display name | The primary and secondary addresses of every interface in the zone |
Items are identified by device ID and object name, so renaming an object in Security Manager shows up as a new item on the next run, and the old one is removed. The first run on a large installation can take an hour or more.
Verify it landed
| What to check | Where to look |
|---|---|
| The account has no errors | Settings > Accounts: no warning icon on the Security Manager account, and its Provision page shows no Resource Errors |
| The item count | Integrations in the main navigation: the Security Manager row is Active with an Items count |
| The items themselves | Inventory > Resources, filtered by Vendor > Security Manager. You should see items of type Network Object and Zone, with totals roughly matching Security Manager |
Once they're in inventory, network objects and zones can be selected into a Group like any other item, for example every zone on a device, or every network object whose name matches a pattern, and exported to Azure, Panorama, or NSX.
Details and edge cases
Only the default domain is covered. Devices in other Security Manager domains aren't discovered today.
Clustered Security Manager is supported. Each application server runs the Insights plugin and holds its own connection; one Connect account covers the whole cluster.
Moving Security Manager to a new server makes Insights reject the new host's connection, as a safeguard against restored backups. Ask FireMon Support to allow the new hostname; discovery resumes on its own once it's allowed.
For common issues, see Troubleshooting.
Insights documentation
- Connect Your SIP Instance: registering Security Manager with Insights, and what registration does
- Insights prerequisites: versions, firewall rules, and licensing for the registration
- Insights troubleshooting: when the registration itself is the problem