Connectors — what each one needs

Cerynix blocks outbound requests to non-public addresses by default. That default is right for a multi-tenant service and was wrong as the only option for on-prem, where the integration targets are supposed to be on your network. Set the ranges you integrate with:

CONNECTOR_ALLOWED_CIDRS=10.20.0.0/16,192.168.213.0/24

Without it, a connector pointed at an internal address fails with destination resolves to a non-public address. Scope it to what you actually integrate with rather than 0.0.0.0/0. It applies to connectors only — webhooks and OIDC discovery keep the strict public-only policy — and loopback, link-local (including the 169.254.169.254 metadata endpoint), unspecified and multicast stay blocked whatever you list. Each permitted internal destination is recorded on the connector run (summary.internal_egress_allowed), so the exception is auditable rather than invisible.

Every connector marked your network needs CONNECTOR_ALLOWED_CIDRS. The three Microsoft ones talk to fixed cloud hosts and work with no egress configuration at all.

App-only (client credentials) against Microsoft Graph. Register an application, grant the three application permissions below, and grant admin consent — delegated permissions will not work for an unattended sync.

Configuration: tenant_id — your tenant's domain (contoso.onmicrosoft.com) or its directory GUID; client_id — the application (client) id; secret — a client secret. A frequent mistake is pasting the client id into the tenant field, which Azure answers with AADSTS90002: Tenant not found.

What the numbers mean. MFA coverage is measured over enabled member accounts matched to the registration report by directory id; disabled accounts and guests are excluded, and accounts the report does not cover are reported separately as mfa_users_not_in_report rather than being absorbed into the percentage. Devices are identified by their directory object id, so two machines sharing a hostname stay two assets and a renamed machine stays one.

Same app-registration pattern as Entra ID, different application permissions: DeviceManagementManagedDevices.Read.All for Intune; SecurityEvents.Read.All and SecurityAlert.Read.All for Defender. Admin consent is required for both. They can share one app registration or use separate ones — separate is easier to revoke.

All three live on your network, so start with CONNECTOR_ALLOWED_CIDRS.

• FortiGate: create a REST API administrator with a read-only profile and generate its API token. Restrict the admin's trusted hosts to the Cerynix server's address — the token is bearer credentials.
• FortiAnalyzer: a JSON-RPC user with read access. Its JSON-RPC surface differs between firmware versions; if a sync fails on an otherwise valid account, send us the firmware version and the raw response (redacted) — that is the fastest path to a fix, and we would rather hear it than have you work around it.
• FortiClient EMS: a read-only API account.

• Zabbix: an API user with read permission on the host groups you want imported. Point base_url at the frontend (https://zbx.example.internal); the connector posts to /api_jsonrpc.php.
• Splunk: a token whose role may run searches. Point base_url at the management interface (commonly :8089), not the web UI port.

A read-only vCenter account (the built-in Read-only role is enough for VM inventory). Point base_url at the vCenter appliance. If its certificate is internally issued, the connector still validates TLS — install your CA in the trust store rather than disabling verification.

Set email or username and the API version follows automatically — Server has no /rest/api/3 at all, so a Cloud-shaped request there returns 404. Override with api_version if your instance disagrees. Optional jql selects which issues become findings; the default is statusCategory != Done ORDER BY created DESC.

• Tenable / Qualys: an access key and secret key with read scope. The hosted service needs no egress configuration; Tenable.sc / Qualys on-prem does.
• Action1: a read-only API client. Cloud only.
• Trend Vision One: an API key with read scope, from the region your tenant lives in — a key from another region authenticates against nothing.

Generic HTTP/JSON reads any endpoint returning a JSON array of objects and maps fields onto assets. It is the fastest way to bring in a source we do not support natively — and if you build one, tell us what you mapped; that is how a native connector gets prioritised.

CSV / JSON import touch no network at all: you upload the file. Best first step if you want the inventory populated before wiring any credentials.

Connector errors carry the provider's own error code, description and trace id where the provider returns one — up to 1.0.1 we discarded them and reported only the HTTP status, which cost the first pilot client an hour on a wrong tenant id that Azure had named in the response body (their D-23).