Overview

Integrations are how Interno gets its data. You pick a tool from the catalogue, save a set of credentials for it, and Interno starts collecting straight away. From then on it re-collects on a schedule, and you can start a scan by hand whenever you like.

This guide covers finding a tool, adding credentials, what happens when you save, reading scan status and history, automatic re-scans, editing credentials in place, deactivating and deleting, and the full list of connectors with the fields each one asks for.

Prerequisites

• defence:integration:view to open the Integrations page
• defence:integration:credentials:view to see the credentials already saved for a tool
• defence:integration:credentials:create to add or change anything
• API credentials for the tool you want to connect, created in that tool by its administrator
• Network access from Zeron to the tool's API. If that has to go through a proxy, have the proxy addresses ready.

Step 1: Find the Tool

Navigation: Sidebar → Admin → Integrations

1. Click Admin in the sidebar, then Integrations.
2. The catalogue is shown as cards in alphabetical order, 27 to a page, with a pager at the bottom right when there is more than one page.
3. Type in the search box to match on the tool's name, or click the Category filter (Choose Category) and pick a category. The category list has its own Search categories box.

Each card shows:

If nothing matches, the page reads No Tools Available.

Note: You see the tools that Zeron has made available to your organisation, which may be fewer than the full list at the end of this article. To have another tool added, contact your Zeron representative.

Step 2: Add Credentials

Navigation: Sidebar → Admin → Integrations → click a tool's card

1. Click the tool's card. A panel slides in from the right with the tool's logo and name, its Tool Description, and Tool Credentials — the credentials already saved for it.
2. Click Add <tool> Credentials at the top right of the panel. The form opens under the heading Enter <tool> credentials:.
3. Type a Name. See the rules below — it cannot be changed later.
4. If a Version dropdown is shown, select the version of the tool you run.
5. If an Authentication Method dropdown is shown, pick how Interno should sign in. The fields below it change to match.
6. Fill in the tool's own fields. Required fields are marked with a red asterisk.
7. If Zeron must reach the tool through a proxy, set Use Proxy? to True and fill in the proxy fields.
8. Click Save Changes.

While you type the name, the form tells you whether it is acceptable: Only letters, digits, and . _ - are allowed (no spaces). if it is not, and This name can't be changed once added. if it is.

Warning: The name is permanent. It identifies this connection everywhere afterwards, including against every record it collects. Choose it carefully — for example defender-prod, not Defender Prod.

What happens when you save

• The credential is stored and appears as a card in the panel.
• The first scan starts immediately. You do not need to click anything else.
• Interno emails the person who added the integration when the data source is added, when a scan starts, and when it finishes or fails.

Note: There is no "test connection" button, and the credentials are not checked at the moment you save. Wrong credentials show up as a Failed first scan, so check the scan status a few minutes after saving.

Step 3: Check the Scan

Navigation: Sidebar → Admin → Integrations → click a tool's card → Tool Credentials

Saved credentials are listed newest first, five to a page. Each card shows the credential's name, the values of its non-secret fields, and three things on the right.

To read the history:

1. Click the Scan Information icon.
2. The window lists the five most recent scans with Started at, Ended at, Time taken and Status. A value still to come shows N.A.
3. For a Failed scan, hover the Failed chip to read the error message and when it was recorded.

A single scan is allowed to run for up to 72 hours before it is stopped.

Then confirm the data arrived: open Assets → Asset Inventory, and on the Assets Listing tab pick the matching entry in the Source: dropdown. See How to View and Manage Asset Inventory.

Scanning Again

Automatically

Interno re-scans every active credential on a recurring schedule. Once a day it checks each one, and starts a new scan when the last one ended at least a set number of days ago. The interval is set for your deployment; unless Zeron has changed it, it is seven days.

Automatic scanning skips a credential when:

• the credential is deactivated
• a scan for it is still Processing
• its last three scans all Failed — fix the cause and run one successful scan by hand to resume the schedule

There is no control on the Integrations page for choosing your own schedule per integration.

By hand

1. Open the tool's card and find the credential.
2. Click the three-dot Actions button.
3. Click Start Scan.

While a scan is running the entry reads Scanning... and cannot be clicked. Asking for a second scan while one is running is refused with A scan is already in progress for this credential.

Editing an Existing Integration

You can change a saved connection in place. There is no need to delete it and start again.

Navigation: Sidebar → Admin → Integrations → click a tool's card → Actions → Edit

1. On the credential card, click the three-dot Actions button and choose Edit.
2. The form reopens under Edit <tool> credentials:, filled in with what was saved: the readable fields, the version, the authentication method and the proxy settings.
3. Change what you need.
4. Click Update.

Things that behave differently when editing:

Only the fields you actually changed are sent. Editing does not start a scan by itself — use Start Scan afterwards to collect with the new settings.

Deactivating, Activating and Deleting

Navigation: Sidebar → Admin → Integrations → click a tool's card → Actions

Deleting a credential removes the connection. It does not remove the records that connection has already collected.

If your plan limits how many integrations can be active at once, both adding a credential and re-activating one count against that limit. Deactivating or deleting one frees a place.

Connector Reference

These are the connectors in the Interno catalogue, with the category each appears under and the data sets it feeds. Data set names are the tables you later see in Asset Inventory and the query builder.

The Category filter also lists categories that have no connector in them yet, such as Email Security, Container Security and Attack Surface Management (ASM). Choosing one of those shows No Tools Available.

Fields each connector asks for

The fields below are the ones you may see on the form, in order. Fields in bold are required. Fields marked secret are stored encrypted and are never shown back to you. Most connectors also end with a Verify SSL? dropdown, which controls whether the tool's certificate is checked; depending on when the tool was made available to your organisation you may not see it.

Connectors that show a Version dropdown: Arcon PAM, Check Point Next Generation Firewalls (NGFW), Cloudflare WAF, Crowdstrike Falcon, Cyberark PAM, HPE Aruba ClearPass Policy Manager, IBM Guardium, Iraje PAM, Kaspersky Security Center, Kibana, LogRhythm, ManageEngine Patch Manager Plus, Microsoft 365, Microsoft Azure CSPM, Microsoft Intune, Securaa, SentinelOne, Tenable Nessus, Tenable Security Center and Trend Micro.

ServiceNow

ServiceNow may appear in the connector list, but data collection for it has not been released yet. A ServiceNow credential can be saved, but its scans will not bring in data. Do not rely on it until it is announced as available.

AWS CSPM

AWS CSPM assesses the security posture of an AWS account and feeds the results into ZCN_FINDINGS.

What Integrations Do Not Do

• They do not validate credentials when you save. The first scan is the test.
• They do not let you set a per-integration schedule or a scan time.
• They do not let you rename a credential.
• They do not write anything back to the connected tool. Interno only reads.

Troubleshooting

"Only letters, digits, and . _ - are allowed (no spaces)." or "Name may contain only letters, digits, and . _ - (no spaces)." → Remove spaces and any other symbols from the Name, and keep it to 100 characters or fewer.

"Name is required!" → The Name field is empty.

"Credential already exist with this name" → Another credential for the same tool already uses that name. Names are compared without regard to capitals. Choose a different one.

"This name produces a credential ID that is already in use." → The name clashes with an existing connection for this tool. Choose a different one.

"<field> required!" or "<field> cannot be only spaces" → A required field is empty or holds only spaces.

"Invalid version provided" → Pick a value from the Version dropdown rather than leaving an old one in place.

I want to rename an integration → Names are permanent. The field is disabled on edit, and a rename is rejected with Credential name cannot be changed after creation. To use a different name, add a new credential and delete the old one.

The secret fields are empty when I edit → That is deliberate. Existing secrets are never shown. Leave them blank to keep them, or type a new value to replace one.

"No changes to update" → You clicked Update without changing anything. Nothing was saved, and nothing needed to be.

The scan shows Failed → Open Scan Information and hover the Failed chip to read the error. Common causes are wrong or expired credentials, an address Zeron cannot reach, or an API account without enough rights in the source tool. Correct it with Edit, then Start Scan.

The failure message says the integration isn't ready yet and points to support → The scan ended without reporting either data or a specific error. Contact Zeron support with the tool name and the time of the scan.

"A scan is already in progress for this credential" → Wait for the current scan to finish. Start Scan stays as Scanning... until it does.

Automatic scans have stopped for one integration → Check that it is not deactivated, and look at Scan Information: after three failed scans in a row the schedule stops for that credential until a scan succeeds.

"Integration limit reached (x/y). Please upgrade your plan to enable more integrations." → Your plan caps how many integrations can be active at once. Deactivate or delete one you no longer need, or contact your Zeron representative.

Zeron cannot reach a tool on our network → Edit the credential, set Use Proxy? to True, and fill in HTTP Proxy, HTTPS Proxy and, if needed, No Proxy.

The panel shows an Unauthorized image instead of credentials → Seeing saved credentials needs defence:integration:credentials:view.

"No Credentials Available" → Nothing has been saved for this tool yet. Click Add <tool> Credentials.

I cannot see the Add Credentials button or the Actions menu → Adding, editing, scanning, activating and deactivating need defence:integration:credentials:create; deleting needs defence:integration:credentials:delete.

The Integrations page shows an Unauthorized screen → Browsing integrations needs defence:integration:view.

"No Forms Fetched" → The setup form for that tool could not be loaded. Close the panel and reopen it; if it persists, contact support.

The tool I need is not in the catalogue → Your organisation sees only the tools Zeron has made available to it. Contact your Zeron representative. For data no connector covers, see How to Upload Data via Manual Ingestion.

No data appears even though the scan completed → Check the Source: dropdown in Asset Inventory for the data sets listed against the tool above. If the set is missing, the tool returned no records of that kind.

Need more help? Contact support@zeron.one