Networking

Networking is section 06 on the Connections page. It is the egress-observation layer: the connectors that tell you which AI apps people actually reach, seen from the proxy, from the firewall, or (with LayerX) from inside the browser. Connect whichever tiles below match what sits between your users and the internet.

Discovery signals lit from this layer: AI Chatbots in Browser (Netskope, Zscaler), AI Browser Extensions (LayerX), and AI Utilization in Sanctioned SaaS (Cloudflare Zero Trust Access logs). Firewall logs that land in the Zaun data lake also feed the AI-domain matching pack (template).

Most packs from this layer are templates. A template pack deploys paused and does not run until it is confirmed for your environment. LayerX's AI browser extension pack is live-validated and runs as soon as the connection is active.

Several of these connectors also expose response actions: block lists, address objects, and tag-driven policies. Those need write permissions that a read-only setup does not, and each Permissions table below calls out which grant enables them. Grant write only if you plan to use response actions from Monitor.

Alkira Network Cloud

Connector: alkira · Auth: API key (Alkira Portal API) · Requires: any plan

Alkira is a multi-cloud network-as-a-service platform. Its Cloud Services Exchange runs one network across AWS, Azure, GCP, OCI, data centers, branches, and SD-WANs through regional Cloud Exchange Points (CXPs), with segmentation, routing, and inserted firewall services. Reagent uses the Alkira Portal API to read telemetry and inventory from that fabric, and can change traffic policies on it when you ask it to.

Lights up: no discovery signal on its own. This tile gives Reagent the network inventory and telemetry behind your cloud egress, plus response actions (traffic policies, connector removal) from Monitor when the key has the edit role.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need an administrator login to the Alkira Portal.
• Decide whether the key should be read-only or also allowed to change the fabric. The roles on the Alkira user decide what the key can do.

Setup

1. Sign in to the Alkira Portal as an administrator.
2. Go to Settings → User Management.
3. Pick the user that will own the key. Grant that user the roles the operations need: read for telemetry and inventory, edit for response actions and provisioning.
4. Use the KEY button on that user to generate an API key. Copy it.
5. In Reagent, open Connections, click the Alkira Network Cloud tile, enter the portal host, paste the raw API key, and save.

Permissions

Alkira has no per-scope API token. The key inherits the roles of the user it was generated on.

What Reagent reads

• Telemetry: alerts, audit logs, provisioning jobs, connector health
• Inventory: tenant networks, segments, groups, CXPs, cloud connectors, firewall services, traffic policies, routes

---

Cato SASE Cloud

Connector: cato-networks · Auth: API key in the x-api-key header (GraphQL API) · Requires: any plan

Cato SASE Cloud converges networking and security in one cloud service. Reagent queries the Cato GraphQL API for security events, application traffic analytics, firewall policy, and account topology.

Lights up: no discovery signal on its own. Response actions (firewall rules, site isolation, policy publish) run from Monitor when the key has Edit permission.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need an admin login to the Cato Management Application (CMA) that can create API keys.
• Know which CMA URL you log in with. It decides the API region you pick in Reagent.
• Decide whether the key gets View (read-only) or Edit (response actions).

Setup

1. Log in to the Cato Management Application at cc.catonetworks.com, or the regional URL you normally use.
2. Go to Administration > API Management (on some tenants Resources > API Keys).
3. Click Create API Key.
4. Name it (for example Zaun Integration). Set permissions to View for read-only monitoring, or Edit if you want response actions (firewall rules, site isolation, policy publish).
5. Optionally restrict the key by source IP and set an expiration date.
6. Copy the generated API key.
7. Note your Account ID. It is the number in your CMA URL: cc.catonetworks.com/#!/account/XXXX.
8. In Reagent, open Connections, click the Cato SASE Cloud tile, select the API region, paste the API key, enter the Account ID, and save.

Your API region matches the CMA URL you use to log in.

Permissions

What Reagent reads

• Raw and aggregated security events
• XDR incident stories for correlated threat investigation
• Internet and WAN firewall policy configuration
• Application traffic analytics and connection quality metrics
• Sites, users, and admins for enrichment
• Audit trail
• Sandbox analysis results
• Real-time account topology snapshots

---

Cisco Firepower

Connector: cisco-firepower · Auth: Token auth (FMC username and password) · Requires: any plan

Cisco Firewall Management Center (FMC) is the central manager for Cisco firewalls and IPS. Reagent authenticates to the FMC REST API with a dedicated user and reads access policies, intrusion events, network objects, and device status.

Lights up: nothing directly from the API. Firewall logs from these devices that land in the Zaun data lake feed the AI-domain matching pack (template).

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need FMC admin access to create users under System → Users.
• Plan on a dedicated service user for Reagent. Do not reuse a human admin's account (see the limits below).

Setup

1. In FMC, go to System → Users.
2. Create a dedicated user with a read-only admin role or a REST API role.
3. In Reagent, open Connections, click the Cisco Firepower tile, enter the FMC URL, username, and password, and save.

Permissions

What Reagent reads

• Access policies
• Intrusion events
• Network objects
• Device status

---

Cisco Meraki

Connector: meraki-firewall · Auth: Meraki Dashboard API key · Requires: API access enabled on the organization

Cisco Meraki is cloud-managed networking: MX security appliances, MS switches, MR wireless APs, and Systems Manager MDM. Reagent reads the Dashboard API for device and client inventory, MX security events, content filtering, and firewall rules, and can update rules, block clients, or control ports when you ask it to.

Lights up: nothing directly from the API. MX firewall logs that land in the Zaun data lake feed the AI-domain matching pack (template). Response actions (firewall updates, client blocking, port control, Systems Manager commands) run from Monitor when the key belongs to a full organization admin.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need a Meraki organization admin account. Read-only organization admin is enough for data collection.
• Each admin can have up to 2 API keys.
• Decide whether the admin who generates the key is read-only (collection only) or full (collection plus response actions).

Setup

1. Log in to the Meraki Dashboard.
2. Go to Organization > Settings and make sure API access is enabled.
3. Click your username (top right) and open My profile.
4. Under API access, click Generate new API key.
5. Copy the key immediately. It is shown only once.
6. In Reagent, open Connections, click the Cisco Meraki tile, paste the API key, and save.

Permissions

The API key inherits the dashboard permissions of the admin who generated it. There are no per-key scopes.

What Reagent reads

• Organization, network, and device inventory (MX, MS, MR, SM)
• Device health and status (online, offline, alerting)
• Network clients: MAC, IP, OS, connection type, usage
• MX security events: IDS/IPS alerts, malware events, content filtering
• Firewall rules (L3 and L7)
• IDS/IPS and AMP/malware protection settings
• Content filtering: URL allow/block lists, category blocking
• Air Marshal wireless rogue AP detection
• Configuration change audit trail and admin RBAC
• VPN, VLAN, and wireless SSID configuration
• Login security and authentication policy posture

What Reagent can change

Full organization admin only.

• Firewall rules (L3 and L7)
• Switch ports: enable, disable, VLAN changes, port cycling
• Clients: block, unblock, assign group policies
• Systems Manager: remote lock, remote wipe

---

Cloudflare

Connector: cloudflare · Auth: API token (Bearer) · Requires: any plan

Cloudflare sits at the edge: WAF, DDoS mitigation, Bot Management, Zero Trust (Access, Gateway, WARP), DNS, SSL/TLS, and Page Shield. Reagent calls the Cloudflare v4 REST API with an account-scoped token to read Zero Trust Access activity, Gateway rules, WAF events, DNS, and audit logs, and can edit DNS records, firewall rules, and filter lists when you ask it to.

Lights up: AI Utilization in Sanctioned SaaS, from Cloudflare Zero Trust Access logs (template pack, deploys paused until confirmed for your environment). The signal covers apps fronted by Access, not general Gateway browsing. Response actions (DNS edits, firewall rules, filter lists) run from Monitor when the token has the write permissions.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need a Cloudflare login that can create API tokens with account-level permissions.
• Have your Account ID ready. It is in the dashboard URL: dash.cloudflare.com/<accountId>.

Setup

1. Log in to the Cloudflare Dashboard.
2. Go to My Profile → API Tokens.
3. Click Create Token and use the Custom Token template.
4. Add the permissions in the table below. Add the write permissions only if you want response actions.
5. Create the token and copy it. It is shown only once.
6. Note your Account ID from the dashboard URL (dash.cloudflare.com/<accountId>).
7. In Reagent, open Connections, click the Cloudflare tile, paste the API token, enter the Account ID, and save.

Permissions

Read permissions (required):

Write permissions (only for response actions):

What Reagent reads

• WAF security events
• Zero Trust Access logs (the apps users authenticate to through Access)
• Gateway rules
• Device inventory
• DNS records
• Audit logs, for configuration drift
• Page Shield
• SSL certificates
• IP and domain threat intelligence

---

PAN-OS

Connector: paloalto-firewall · Auth: XML API key · Requires: any plan

Palo Alto Networks PAN-OS firewalls provide GlobalProtect VPN, threat prevention, URL filtering, WildFire malware analysis, and traffic visibility. Reagent uses the PAN-OS XML API to read security policies, threat and traffic logs, GlobalProtect sessions, and URL filtering verdicts, and can manage address objects and submit files to WildFire when you ask it to.

Lights up: nothing directly from the API. Traffic and URL logs that land in the Zaun data lake feed the AI-domain matching pack (template). Response actions (address objects, security policy changes) run from Monitor when the API admin has write scopes.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need admin access to the firewall management interface to create admin roles and users.
• Have your Zaun environment's egress IP range on hand for Permitted IPs.

Setup

1. On the firewall, create a dedicated admin role with the read and write API scopes you need, and a dedicated API admin user with that role.

2. Set Permitted IPs on that API admin to your Zaun environment's egress range. Do this before generating the key.

3. Generate the key with the keygen call:

   curl -k -X GET 'https://<host>/api/?type=keygen&user=<user>&password=<pwd>'

4. Copy the <key> value from the response.

5. In Reagent, open Connections, click the PAN-OS tile, enter the base URL, paste the API key, and save.

Permissions

What Reagent reads

• Security policies
• Threat and traffic logs
• GlobalProtect VPN sessions
• URL filtering verdicts
• Address objects

---

Netskope

Connector: netskope · Auth: REST API v2 token (Netskope-Api-Token header) · Requires: any plan

Netskope Security Cloud is an SSE platform: CASB, secure web gateway, ZTNA, DLP, UEBA, cloud firewall, and private access in one cloud-native service. Reagent reads its REST API for alerts, web and app events, client inventory, quarantined files, and user behavior scores, so AI apps reached through the Netskope proxy show up on Discover with the user, app, device, and activity context Netskope has.

Lights up: AI Chatbots in Browser, from Netskope AI app events (template pack, deploys paused until confirmed for your environment).

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need Netskope Admin Console access that can create REST API v2 tokens.
• Know your tenant URL, for example acme.goskope.com.

Setup

1. Log in to the Netskope Admin Console.
2. Go to Settings → Tools → REST API v2.
3. Click New Token.
4. Assign the six endpoints listed under Permissions.
5. Copy the token.
6. In Reagent, open Connections, click the Netskope tile, enter the tenant URL and the token, and save.

Permissions

Netskope v2 tokens are scoped by endpoint. Assign all of these when you create the token.

What Reagent reads

• Alerts: DLP, anomaly, policy, malware
• Events: web, app, network, audit
• Enrolled client inventory
• Quarantined files
• User behavior scores (UEBA)
• URL classification
• Private access publishers and apps
• File threat intelligence

---

FortiGate

Connector: fortigate-firewall · Auth: REST API admin token (Authorization: Bearer header) · Requires: any plan

FortiGate is Fortinet's next-generation firewall. Reagent uses the FortiGate REST API to read firewall policies, address objects, traffic logs, and system status, and can create address objects when you ask it to.

Lights up: nothing directly from the API. Traffic logs that land in the Zaun data lake feed the AI-domain matching pack (template). Response actions (address objects) run from Monitor when the admin profile has write on firewall.address.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need FortiGate web UI access that can create admin profiles and REST API admins.
• Know the management URL: a hostname or IP, with the port if it is not the default, for example fortigate.example.com or 10.0.0.1:10443.
• Know whether the appliance serves its management interface with a private or self-signed CA.
• Have your Zaun egress IP range on hand for Trusted Hosts.

Setup

Create the admin profile first, then the REST API admin that uses it.

1. Log in to the FortiGate web UI.
2. Go to System > Admin Profiles and click Create New.
3. Grant read access to Firewall, Log & Report, and System. Grant write on Firewall only if you want Reagent to create address objects.
4. Save the profile.
5. Go to System > Administrators and click Create New > REST API Admin.
6. Set a username (for example zaun-api) and select the profile from step 4.
7. Under Trusted Hosts, restrict to your Zaun egress IP range (recommended).
8. Click OK. The API token displays once. Copy it immediately.
9. In Reagent, open Connections, click the FortiGate tile, enter the management URL, paste the token, leave Verify TLS certificates on unless the appliance uses a private or self-signed CA, and save.

Permissions

For the operations Reagent calls today, the REST API admin's profile needs these.

What Reagent reads

• Firewall policies
• Address objects
• Traffic logs
• System status

---

Zscaler

Connector: zscaler-zia · Auth: OAuth 2.0 client credentials · Requires: any ZIA tenant

Zscaler Internet Access (ZIA) is a cloud secure web gateway: URL filtering, firewall, DLP, sandboxing, and advanced threat protection. Reagent reads the ZIA API for URL categorization, firewall and URL filtering policy, cloud application control, DLP configuration, and user, group, department, and location inventory, so AI apps reached through Zscaler show up on Discover as app-level sightings: app name, risk index, sanctioned state, and user and byte counts per app, without per-user or per-location attribution.

Lights up: AI Chatbots in Browser, from ZIA Shadow IT AI apps (template pack, deploys paused until confirmed for your environment). Response actions (URL categories, block rules, denylist entries) run from Monitor when the API role can write.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need ZIA Admin Portal access to Administration > Authentication Settings > API Key Management.
• Know your cloud instance. It is in your admin portal URL (table below).
• Know your org ID and the API role you will put in the OAuth scope.

Setup

1. Log in to the ZIA Admin Portal. Use the URL for your cloud, for example admin.zscaler.net.
2. Go to Administration > Authentication Settings > API Key Management.
3. Create an OAuth 2.0 client. This generates a Client ID and Client Secret.
4. Note the scope format the client requires: <cloud>::<org-id>::<api-role>.
5. Copy the Client ID and Client Secret.
6. In Reagent, open Connections, click the Zscaler tile, select the cloud instance, paste the Client ID and Client Secret, and save.

Your cloud instance is visible in your ZIA admin portal URL.

Permissions

ZIA scopes the OAuth client as <cloud>::<org-id>::<api-role>. The API role you assign to the client decides what Reagent can do.

Rate limits

ZIA enforces these per tenant.

What Reagent reads

• Real-time URL categorization lookups
• Cloud sandbox analysis reports by file hash
• Firewall and URL filtering policy rules
• DLP dictionaries and engine configuration
• SSL inspection rules and cloud application control policies
• Advanced threat protection settings and malicious URL denylists
• Users, groups, departments, and locations for enrichment
• Security policy configuration for compliance and posture

---

LayerX

Connector: layerx · Auth: API token (Client ID and Secret Key), sent as HTTP Basic · Requires: any LayerX tenant

LayerX is an agentless browser and AI-usage security platform delivered as an enterprise browser extension. It sees what the proxy and the firewall cannot: which extensions are installed in each browser, and which GenAI and agentic-browser policies apply. Reagent reads the LayerX REST API for device and extension inventory, policy configuration, and tags, and drives response through tags.

Lights up: AI Browser Extensions (live-validated pack; it runs as soon as the connection is active). Response actions (tagging an extension or other asset so an existing LayerX policy acts on it, and alert triage write-back) run from Monitor when the token carries the Tag Admin and Alerts Reader roles.

LayerX delivers its security event stream by push to the log destination you configure in the LayerX console, rather than exposing events for polling. This connection covers inventory, policy, and response, not the event stream itself.

Before you start

• You need the manage integrations permission in Reagent (Administrator, MSSP Admin, or a custom role with it).
• You need LayerX console access to Settings → API Tokens.
• Decide which roles the token gets (see Permissions). Read Only is enough for discovery.
• Leave region detection to Reagent. Pick a region by hand only if detection cannot decide.

Setup

1. In the LayerX console, go to Settings → API Tokens and click Generate Token.
2. Enter a description that names this integration, for example Zaun.
3. Select the roles (see Permissions), set an expiry, and click Create.
4. Copy the Client ID and Secret Key. The Secret Key is shown only once.
5. In Reagent, open Connections, click the LayerX tile, paste the Client ID and Secret Key, leave Region on automatic detection, and save. Saving probes all five LayerX API hosts with your token and keeps the one that holds your data.
6. Run a credential health check after saving to confirm the pair authenticates and returns data.

LayerX homes each tenant on one of five API hosts (Global, US East 1, US East 1 prod02, AP Northeast 1, Japan), and the console domain does not say which. A wrong manual pick does not fail loudly: LayerX answers every request on the wrong shard with an empty result, so the connection looks healthy and reports no devices, extensions, or policies.

Permissions

What Reagent reads

• Device discovery: endpoints observed through the LayerX browser extension
• Extension discovery: browser extensions across the fleet, with permissions and risk data
• Policy configuration: secure browsing, data control, browser posture, GenAI and agentic-browser policies
• Tags: the named asset groups your policies match on

Response actions

Writes go through tags. Adding an asset to a tag that an existing LayerX policy references is how a containment action takes effect: tag a malicious extension, and the block policy already watching that tag picks it up.

• Create tags and add, remove, or annotate their assets
• Update an alert's triage status after investigation

A plain tag update replaces the full asset list. Use the upsert action when you mean to add an asset without disturbing what is already there.