> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Nozomi Networks

> Connect Nozomi Networks OT and IoT security monitoring to Serval with an API key so workflows can read alerts, asset inventory, vulnerabilities, and sensor health from Guardian, CMC, or Vantage. Currently in beta.

## About Nozomi Networks

Nozomi Networks is an operational technology (OT) and Internet of Things (IoT) security monitoring platform. It watches industrial and connected devices, raises alerts on suspicious or risky activity, keeps an inventory of the assets it sees, and reports on their vulnerabilities. Serval connects to your Nozomi deployment with an API key so workflows can read this security data and act on it. The Nozomi Networks integration is currently in **beta**.

Nozomi ships in two forms, and each connection points at one of them:

* **Guardian / CMC (on-premises).**
  Guardian appliances (and the Central Management Console, CMC, that aggregates them) run inside your own network. A connection points at the appliance's own URL.
* **Vantage (cloud).**
  Vantage is Nozomi's cloud platform, reached at your tenant's `vantage.nozominetworks.io` address.

<Note>
  A connection is tied to the product you pick when you create it. You can't switch an existing connection between Guardian/CMC and Vantage, because that would repoint every workflow using it at a different system. To move to the other product, create a new Nozomi Networks connection.
</Note>

**Authentication**

Serval authenticates with an API key created in Nozomi for a dedicated service user: a key name and a key token. On Guardian and CMC this is an OpenAPI key; on Vantage it's an API key. Serval stores the token encrypted and exchanges it for a short-lived session each time it calls Nozomi, so the workflows you build never handle the key directly. The service user's permissions in Nozomi determine what Serval can read.

**Data sync**

On demand only. Serval calls Nozomi at the moment a workflow step runs. There is no background sync, and the integration ships no pre-installed workflows.

## What the Nozomi integration enables

The capabilities available depend on which product the connection points at.

**Guardian and CMC**

| Capability          | Description                                                                                                                                   |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Alerts              | List and read alerts, follow an alert to its supporting detail, and acknowledge or close alerts.                                              |
| Asset inventory     | Query the assets Guardian has discovered on the monitored network.                                                                            |
| Ad hoc queries      | Run Nozomi's own query language to pull tailored views of alerts, assets, and other monitored data.                                           |
| Network captures    | Work with recorded network traffic and packet captures for investigation.                                                                     |
| Users and groups    | Read and manage the appliance's own users and user groups.                                                                                    |
| Reports             | Generate reports and work with report templates.                                                                                              |
| Quarantine          | Read and manage quarantined items.                                                                                                            |
| Threat intelligence | Read the appliance's threat intelligence data.                                                                                                |
| Sensor health       | Read sensor resource and license information (reading sensor resources requires a service user with the admin role or the health permission). |

**Vantage**

| Capability        | Description                                                     |
| ----------------- | --------------------------------------------------------------- |
| Alerts            | List and read alerts across the tenant.                         |
| Assets and sites  | Read the asset inventory and the sites assets are grouped into. |
| Vulnerabilities   | Read the vulnerabilities Vantage has identified.                |
| Sensors           | List the sensors connected to the tenant.                       |
| Wireless networks | Read discovered wireless networks.                              |

## Get your credentials

You create an API key in Nozomi for a dedicated service user, and give Serval the key's name and token. The service user's permissions decide what Serval can read, so grant it the access your workflows need.

<Steps>
  <Step title="Create a dedicated service user">
    In Nozomi, create (or choose) a service user for Serval and give it the permissions your workflows require. On Guardian or CMC, include the admin role or the health permission if you plan to read sensor resource metrics.
  </Step>

  <Step title="Create the API key">
    Generate a key for that user: an OpenAPI key on Guardian or CMC, or an API key on Vantage. Note the key name.
  </Step>

  <Step title="Copy the key token">
    Copy the token shown when the key is generated and store it somewhere safe. It's shown only once.
  </Step>

  <Step title="Note the URL Serval should connect to">
    For Guardian or CMC, use your appliance's URL (for example `https://guardian.example.com`). For Vantage, use your tenant URL (for example `https://company.customers.us1.vantage.nozominetworks.io`).
  </Step>
</Steps>

<Warning>
  For Guardian and CMC, the appliance runs inside your own network, so its URL must be reachable from Serval. If Serval can't reach the appliance, the connection can't sign in.
</Warning>

## Connect in Serval

Open your team workspace, go to **Integrations → Connect new**, choose **Nozomi Networks**, and fill in the connect form.

<Steps>
  <Step title="Choose the Product">
    Select **Guardian / CMC (on-premises)** or **Vantage (cloud)**. The URL field changes to match your choice. Remember that this can't be changed later.
  </Step>

  <Step title="Enter the URL">
    For Guardian or CMC, enter the appliance URL. For Vantage, enter your tenant URL, which must be a `vantage.nozominetworks.io` address.
  </Step>

  <Step title="Enter the Key Name">
    Enter the name of the OpenAPI key (Guardian or CMC) or API key (Vantage) you created for the service user.
  </Step>

  <Step title="Enter the Key Token">
    Paste the key token. Serval stores it encrypted and only uses it to obtain the short-lived sessions it needs to call Nozomi.
  </Step>

  <Step title="Submit the form">
    Submit to create the connection, then run the health checks below to confirm everything works.
  </Step>
</Steps>

<Note>
  When you edit an existing connection, leaving the Key Name or Key Token blank keeps the stored value, so you can update one without re-entering the other. The Product can't be changed on edit.
</Note>

## Verifying the connection

When you connect, Serval confirms it can authenticate with the appliance or tenant. The integration also includes four built-in health checks you can run at any time from the connection's **API Integration** tab:

| Check               | What it verifies                                                                                                                                                                                |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Test Connection     | Confirms Serval can authenticate with the configured Guardian/CMC appliance or Vantage tenant.                                                                                                  |
| List Alerts         | Confirms the service user can read alerts.                                                                                                                                                      |
| List Assets         | Confirms the service user can read the asset inventory.                                                                                                                                         |
| Check Sensor Health | Reads sensor health: resource metrics on Guardian/CMC, or the connected-sensor list on Vantage. On Guardian/CMC this requires the service user to have the admin role or the health permission. |

<Tip>
  If Test Connection passes but a specific check fails, the service user is reachable but lacks permission for that area in Nozomi. The most common example is Check Sensor Health on Guardian/CMC, which needs the admin role or the health permission. Widen the service user's permissions and rerun the check.
</Tip>

## Gotchas and troubleshooting

<AccordionGroup>
  <Accordion title="The product can't be changed after connecting">
    A connection is fixed to Guardian/CMC or Vantage from the moment you create it, because each product exposes a different set of capabilities and workflows are built against one of them. To use the other product, create a separate Nozomi Networks connection.
  </Accordion>

  <Accordion title="Guardian and CMC must be reachable from Serval">
    On-premises appliances live inside your network. If Serval can't reach the appliance URL, sign-in fails. Confirm the URL is correct and that network access from Serval to the appliance is allowed.
  </Accordion>

  <Accordion title="Vantage needs its tenant URL">
    A Vantage connection must point at a `vantage.nozominetworks.io` address (for example `https://company.customers.us1.vantage.nozominetworks.io`). A different host is rejected when you save.
  </Accordion>

  <Accordion title="Serval can only do what the service user can do">
    Everything Serval reads is bounded by the permissions of the service user whose key you configured. If a workflow gets a permission error while the connection looks healthy, widen that user's access in Nozomi.
  </Accordion>

  <Accordion title="Beta integration">
    The Nozomi Networks integration is marked beta in the connect screen. Behavior and available capabilities may change.
  </Accordion>
</AccordionGroup>

***

Need help? Contact **[support@serval.com](mailto:support@serval.com)** for assistance with your Nozomi Networks integration.