[New Integration] Nozomi Networks

[cpascale43]

Description

Nozomi Networks provides network and endpoint visibility & threat detection for OT/IoT. The integration should collect data from Nozomi's platform components - Vantage, Central Management Console (CMC) and Guardian via API. Access to a sample tenant is available on request.

Architecture

Following Nozomi's recommendations, integration can be built via CEF/syslog or using their Universal API. The integration should retrieve the following data types. Please see Nozomi's data model reference documentation for a full list of fields.

Alerts

• Security and operational anomalies categorized by severity, type and affected assets

Assets

• Inventory of discovered OT/IoT devices including classifications and network information - this should map to Elastic's asset inventory.

Asset Updates

• Real-time changes to device configurations, only available for customers using CMC All-in-One and Vantage
• Not supported in Guardian or CMC Multicontext deployments

NodeCVEs

• Identified CVEs for specific nodes/devices in the network

Nodes

• Individual devices and endpoints detected on the network

Health logs

• System status information and performance metrics from Nozomi platform

Audit logs

• Records of user activities and system configuration changes

Variables

• Industrial control system process variables and parameters

Sessions

• Live, mostly open, sessions between nodes. A session is a specific application-level connection between nodes. A link can hold one or more sessions at a given time