Integrations

An integration is a configured source of asset data. Most are a connection to a system that already knows something about your estate — an EDR, a directory, a cloud subscription — which Lumen Edge reads on a schedule and folds into the asset inventory. Two of them, the active and passive scanners, read the network itself instead.

Every integration in the catalogue below has its own page covering what it contributes, what you have to configure, and what it needs permission to read in the source system. This page covers the parts they all share.

How an integration runs

Integrations do not run in the console. Each one is assigned to a sensor, and the sensor is what makes the outbound calls. A run goes through the same stages regardless of type:

Two consequences are worth internalising:

• The sensor makes every call, so it needs network reach to the source system — including through a proxy if one stands in the way. Credentials are stored with the integration instance in the console and handed to the sensor with the task, so they are used from inside your network but not kept there.
• Nothing is written straight to an asset. A run produces change entries, and what happens to them is governed by the integration's action settings described below.

Configuration model

Every integration has two layers of configuration. The first is the connection itself, and is specific to the type — see each integration's page.

The second layer is a scan template, and is near-identical everywhere:

Group	Setting	What it does
Basic	Template name, description	Labels the template
Advanced	Ignore if host is offline	How long a record may go unseen before it stops refreshing the asset
Advanced	Scan timeout	Upper bound on a single run
Actions	On new asset discovered	Create asset automatically (default), To approve, or Ignore
Actions	Existing asset updated	Update asset automatically (default), To approve, or Ignore
Actions	Asset missing	Do nothing (default), To approve, or Delete asset
Actions	On scan complete / on scan failed	Send email

Start with "To approve" on a new integration

Setting On new asset discovered to To approve for the first few runs lets you see what a source actually asserts before it can create anything. It is much easier than unpicking a few thousand automatically created assets afterwards.

"Delete asset" acts on the source's silence

Asset missing fires when the source stops returning a record — which happens when an asset is decommissioned, but equally when a credential expires or a console-side filter changes. Prefer To approve.

How integration data lands on an asset

Each integration writes two kinds of field:

• Prefixed fields, namespaced to the integration — cs_* for CrowdStrike, defender_* for Windows Defender, nessus_* for Nessus, and so on. These are the source's own view, kept verbatim so you can always see who said what.
• Shared asset fields — names, os, os_vendor, type, private_ip, mac, updated_at and friends. Several integrations write these, which is precisely the point: they are what correlation uses to decide that the CrowdStrike host and the Nessus agent are one machine.

Each type also sets a boolean presence flag — cs_exits, nessus_exits, azure_md_exits — which is the cheapest way to filter for "assets this source knows about", and by inversion, coverage gaps.

Where two sources disagree on a shared field, some integrations write in do-not-override mode so they enrich an empty field but never clobber a populated one. The asset detail view shows which source asserted each value; see Assets.

Catalogue

Network discovery

These two do not read an external system at all — the sensor itself is the source, probing or observing your network directly. They are how you find assets that no agent and no cloud API knows about, so they belong at the top of any rollout plan.

Integration	Contributes
Active scanner	Hosts, open ports, services and device identity, established by probing
Passive scanner (WIP)	Hosts inferred from mirrored traffic, without sending anything

Endpoint detection and response

Integration	Contributes
CrowdStrike	Managed endpoints
CrowdStrike process events (WIP)	Process telemetry from managed endpoints
Carbon Black (WIP)	Managed endpoints
Windows Defender (WIP)	Managed endpoints

Cloud and virtualisation

Integration	Contributes
Azure managed devices (WIP)	Devices enrolled in Azure management
Azure VMs (WIP)	Virtual machines from Azure subscriptions

Directory and identity

Integration	Contributes
Active Directory (WIP)	Computer objects
Active Directory users (WIP)	User identities
LDAP users	User identities from a generic LDAP directory
Azure users (WIP)	User identities from Entra ID
Atlassian users (WIP)	User identities from Atlassian Cloud

Vulnerability and network

Integration	Contributes
Nessus agents	Agent-based vulnerability data
Vectra NDR (WIP)	Network-detected hosts

Elastic

Integration	Contributes
Elastic agent	Hosts reporting an Elastic agent
Elastic aggregation query (WIP)	Assets derived from an arbitrary aggregation over your own indices

Ownership enrichment

These are consulted only to resolve who owns an asset; they do not create assets.

Integration	Resolves owner from
Elastic asset owner (WIP)	An Elastic index
CrowdStrike asset owner (WIP)	CrowdStrike logon telemetry

Adding an integration

1. Integrations → Add integration.
2. Pick the type.
3. Supply credentials and scope, and choose the sensor that will run it.
4. Save. The first sync is queued.

Use a dedicated service principal

Give each integration its own read-only service account rather than reusing an existing one. It makes revocation and audit straightforward, and it keeps Lumen Edge's access visible in the source system's own logs.

Monitoring integration health

Each integration's detail view shows its last run, the record count and any errors. An integration that fails silently is the most common cause of an inventory that "looks stale" — check here first.

Credentials expire

Cloud and SaaS credentials rotate or lapse. A failing integration stops refreshing its assets but does not remove them, so coverage degrades quietly. Watch for repeated auth failures.

See also

• Core concepts — how sources combine into one asset
• Assets — inspecting which source asserted an attribute
• Sensors — the component that actually runs each integration