NEONIX SECURITY FABRICEXPOSURE / APPLICATION / IDENTITY
NEONITECHNOLOGIES

Resources · documentation

Integration documentation.

Setup steps, authentication method and synced data for every live Neonix integration.

Identity

Microsoft Entra ID

Live

Authentication

OAuth 2.0 app registration (client credentials)

Data synced

Identity inventory, access context

  1. 1.Register an app in Entra ID with Directory.Read.All
  2. 2.Add the client ID, tenant ID and secret in Neonix under Integrations
  3. 3.Select which groups and applications to sync
Identity

Active Directory

Live

Authentication

LDAPS service account

Data synced

Directory identities, group context

  1. 1.Create a read-only service account with LDAP bind rights
  2. 2.Point the Neonix connector at your domain controller over LDAPS
  3. 3.Choose the organizational units to sync
Identity

Okta

Live

Authentication

Read-only API token

Data synced

Identity inventory, authentication context

  1. 1.Generate an API token scoped to read-only access
  2. 2.Add your Okta domain and token in Neonix
  3. 3.Select the groups and apps to bring into scope
Identity

Keycloak

Live

Authentication

Confidential client (client credentials)

Data synced

Identity inventory, role context

  1. 1.Create a confidential client with service accounts enabled
  2. 2.Grant the client realm-management view roles
  3. 3.Add the client ID and secret in Neonix
SIEM

Microsoft Sentinel

Live

Authentication

Azure Log Analytics workspace connection

Data synced

Security events, alert forwarding

  1. 1.Grant Neonix a reader role on the Log Analytics workspace
  2. 2.Add the workspace ID and key in Neonix
  3. 3.Choose which tables to stream
SIEM

Splunk

Live

Authentication

HTTP Event Collector (HEC) token

Data synced

Security events, risk signals

  1. 1.Enable HEC on your Splunk instance
  2. 2.Generate a HEC token scoped to the target index
  3. 3.Add the HEC endpoint and token in Neonix
Security

Elastic

Live

Authentication

API key (read/write on target index)

Data synced

Event export, investigation context

  1. 1.Create an API key scoped to the relevant index pattern
  2. 2.Add the Elasticsearch endpoint and key in Neonix
  3. 3.Map the fields you want exported
SOAR

Cortex XSOAR

Live

Authentication

API key integration

Data synced

Alert actions, response workflows

  1. 1.Generate an API key in XSOAR settings
  2. 2.Add the server URL and key in Neonix
  3. 3.Select which playbooks Neonix can trigger
Security

Microsoft Defender

Live

Authentication

Microsoft Graph Security API app registration

Data synced

Threat context, asset context

  1. 1.Register an app with SecurityEvents.Read.All
  2. 2.Add the client ID, tenant ID and secret in Neonix
  3. 3.Choose the alert and asset types to import
Cloud

AWS

Live

Authentication

Cross-account IAM role (read-only)

Data synced

Cloud assets, exposure context

  1. 1.Create a cross-account IAM role with the Neonix trust policy
  2. 2.Attach the provided read-only policy
  3. 3.Add the role ARN and external ID in Neonix
Cloud

Microsoft Azure

Live

Authentication

Service principal (Reader role)

Data synced

Cloud assets, identity context

  1. 1.Create a service principal scoped to the subscription
  2. 2.Assign it the Reader role
  3. 3.Add the tenant, client and secret in Neonix
Cloud

Google Cloud

Live

Authentication

Service account (Viewer role)

Data synced

Cloud assets, exposure context

  1. 1.Create a service account with the Viewer role
  2. 2.Generate and download a JSON key
  3. 3.Upload the key in Neonix and select projects to scan
Infrastructure

Kubernetes

Live

Authentication

Read-only service account + kubeconfig

Data synced

Workloads, service exposure

  1. 1.Apply the Neonix read-only ClusterRole
  2. 2.Generate a kubeconfig for the service account
  3. 3.Upload the kubeconfig in Neonix
ITSM

ServiceNow

Live

Authentication

REST API user (Table API)

Data synced

Ticket creation, workflow status

  1. 1.Create a REST API user scoped to the incident table
  2. 2.Add the instance URL and credentials in Neonix
  3. 3.Map severity levels to ServiceNow priorities
ITSM

Jira

Live

Authentication

API token

Data synced

Issue creation, workflow status

  1. 1.Generate an API token from your Atlassian account
  2. 2.Add your Jira URL, email and token in Neonix
  3. 3.Select the project and issue type for new tickets
DevSecOps

GitHub

Live

Authentication

GitHub App installation

Data synced

Repository context, workflow events

  1. 1.Install the Neonix GitHub App on the target org
  2. 2.Grant read access to code and workflow events
  3. 3.Select repositories to bring into scope
DevSecOps

GitLab

Live

Authentication

Project access token

Data synced

Repository context, pipeline events

  1. 1.Generate a project or group access token with read_api scope
  2. 2.Add the token and GitLab URL in Neonix
  3. 3.Select projects to sync pipeline events from