Axonius

No entries match these filters. Clear filters

1. Axonius Release Notes 10.0.1 (2026-10-26) Oct 26, 2026 · issue 125

   Axonius 10.0.1 adds AI Workforce auto-pause, a new Adapter Noise Filters Worker, AVS factor querying, Security Finding Risk Score v2, and scoped Vulnerability Repository access.

   • AI Workforce scheduled workers now pause automatically after 14 consecutive runs with the same result and no action taken; a notification card in AI Workforce > Notifications explains the pause and offers Resume.
   • Adapter Noise Filters Worker is a new weekly AI Workforce worker in the IT Asset Management department that finds uncorrelated devices and identifies which adapters bring them in, pointing to Advanced Settings for remediation.
   • Query AVS factors as structured fields on the Aggregated Security Findings and Vulnerability Repository pages using the Query Wizard, with autocomplete for each factor's Impact and value, plus support for custom values.
   • Security Finding Risk Score v2 now weights Axonius Vulnerability Score at 60% (up from 50%) and Asset Criticality at 35% (up from 25%); activating v2 deactivates v1 without deleting it, and scores recalculate immediately.
   • Scoped users and admins in a data scope can now open the Vulnerability Repository and use its table, filters, queries, charts, and export.

   +2 more show less

   • Agent Coverage Workspace adds a Manage agents panel to control which agents appear in the workspace, its dashboard, and AI agent answers, with a new Manage Agent Coverage role permission granted to the Admin role by default.
   • Threat Intelligence notable events — including indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. hunting queries — are now readable by the AI agent and usable in its answers.

   7 details in Everything

   • New integration CMDB Reconciliation Workspace adds six new ITSM adapter sources
   └──▷ BREAKING ON UPGRADE

   • !Activating Security Finding Risk Score v2 deactivates v1; anything built on the previous scores (queries, dashboards, enforcement sets) may show different risk levels immediately after activation.
2. Axonius Release Notes 10.0.0 (2026-10-11) Oct 11, 2026 · issue 110

   Axonius 10.0.0 ships Axonius AI (Companion, Workforce, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface.), asset-correlation investigation, AI attribute fields for software/SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., and expanded exposure management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Prevent stale, long-closed findings from cluttering your Security Findings inventory by enabling automatic removal after 30 days.
   📍In the Axonius console, go to Global Settings → Security Findings Data → Status Resolver, enable the auto-remove option, and set the threshold to 30 days.
   Audit why two device records were not merged to resolve an unexpected duplicate before opening a support ticket.
   📍On the Devices page, select two device records, then choose Explain Non-Correlation to view the specific field discrepancies that prevented the merge.
   • Adds Auto Approve Managed SaaS Applications setting in Settings → Enrichment to control whether managed SaaS applications receive automatic approval status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Status Resolver option in Global Settings → Security Findings Data → Status Resolver to automatically remove security findings closed for more than a configurable number of days (default 14 days for new customers, off for existing).
   • Adds Preferred: Device Type preferred field, calculated post-correlation, usable across Query Wizard, reports, dashboards, and Enforcement Sets — replacing the legacy Device Type identifier field.
   • Introduces Axonius AI Companion for querying asset data in natural language, translating plain-English questions into queries, charts, dashboards, and actions with a visible correlation path for analyst verification.
   • Introduces Axonius AI Workforce, a platform-wide automation engine for end-to-end ticket creation, policy enforcement, and case updates driven by asset context.

   +5 more show less

   • Introduces Axonius MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server, exposing the full Axonius environment to external AI tools, agents, IDE assistants, and low-code platforms via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
   • Adds Explain Correlation and Explain Non-Correlation modules to investigate why device records were merged or kept separate, with AI-assisted deep-dive for Axonius AI customers.
   • Adds seven AI attribute fields (AI: Deployment, AI: Model Location, AI: Autonomy Level, AI: Integrations, AI: RAG Enabling, AI: RBAC Supported, AI: Vendor Training) automatically populated on Software, installed software, and SaaS Application assets.
   • Adds three new count fields to Aggregated Security Findings: Open Security Findings, Closed Security Findings, and Risk Accepted Security Findings as a complete, non-overlapping partition of Axonius Status values.
   • Adds customizable email templates for Exception Management, supporting custom subject, intro text, and rich-text body for seven exception email types including new approval request, approval reminder, request approved/denied, request update, expiration warning, and expired.

   10 details in Everything

3. docs update Oct 11, 2026 · issue 102

   Axonius adds preconfigured Dashboard Templates with preview, adapter guidance, and personal preferences to accelerate environment visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Spin up a security-relevant dashboard in minutes using a preconfigured template instead of building charts from scratch.
   📍In the Axonius Dashboard page, click Add Dashboard › Dashboard Templates, hover over a template tile and click Preview to inspect sample charts and required adapters, then click Select to create the dashboard.
   Identify and connect missing data sources immediately after creating a template-based dashboard to populate empty charts.
   📍After creating a dashboard from a template, locate any chart flagged as missing adapter data, click Connect Adapters in the inline widget, and the Adapters page opens pre-filtered to the relevant adapter category.
   • Adds Dashboard Templates: preconfigured dashboards built around common themes (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ use-case categories), selectable from the Add Dashboard > Dashboard Templates menu entry.
   • Adds a Preview mode for each template tile, showing sample chart thumbnails, adapter requirements, and per-chart descriptions before committing to a template.
   • Adds a Connect Adapters prompt within template-based dashboards that surfaces missing adapter categories and links directly to the Adapters page filtered to the relevant category.
   • Adds personal preference settings on the Select a Template page, allowing practitioners to tailor recommended templates and adapter suggestions to their role and interests.

   4 details in Everything

4. docs update Oct 11, 2026 · issue 102

   Axonius adds faster asset and user deletion settings for healthy connections, with per-connection or adapter-wide control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Keep asset data fresh when a connector is healthy by deleting stale devices within 12 hours instead of waiting for the 48-hour fallback threshold.
   📍In the adapter's Advanced Settings, set 'Delete devices and other assets that have not been returned from the source in the last X hours' (fast-deletion) to 12, and confirm 'Delete devices that have not been returned from the source in the last X hours' (standard threshold) is set to 48.
   Accelerate stale-user removal during normal operation while retaining a safety net if the connection degrades.
   📍In the adapter's Advanced Settings, set 'Delete users that have not been returned from the source in the last X hours' (fast-deletion) to 6 for the specific connection, and confirm 'Delete users that have not been returned from the source in the last X hours' (standard threshold) is set to 24.
   • Adds a new 'Delete devices and other assets that have not been returned from the source in the last X hours' accelerated-deletion setting that removes assets sooner when a connection is fetching successfully, independently of the existing deletion threshold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new 'Delete users that have not been returned from the source in the last X hours' accelerated-deletion setting that removes users sooner when a connection is fetching successfully, independently of the existing deletion threshold.
   • Both new faster-deletion settings can be scoped per-connection or applied to all connections for an adapter, and both require a value lower than their corresponding standard deletion threshold.
   • Adds a new 'Delete devices and other assets that have not been returned from the source in the last X hours' accelerated-deletion setting that removes assets sooner when a connection is fetching successfully, independently of the existing deletion threshold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new 'Delete users that have not been returned from the source in the last X hours' accelerated-deletion setting that removes users sooner when a connection is fetching successfully, independently of the existing deletion threshold.

   1 more in Everything

5. docs update Oct 10, 2026 · issue 101

   Axonius Asset Graph gains customizable node labels with per-adapter field selection and system-default persistence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   When investigating device ownership in a graph, label nodes with the owner email address so each device is immediately identifiable without drilling down.
   📍1. Open the Asset Graph page. 2. In the upper-right corner, click (Customize Nodes). 3. Under Displayed assets, select the Devices asset type. 4. Choose the relevant adapter and set the field to Email address. 5. Select Set as system default to persist this labeling for all devices. 6. Click Apply.
   • Adds a Customize Nodes control on the Asset Graph page that lets practitioners select an adapter and field whose value becomes the node label for each asset type (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ device owner name or email address).
   • Supports setting custom node-label selections as the system default via Set as system default, so all assets of that type are labeled with the chosen field value across sessions.
   • Provides a Reset to system default action to clear all custom label settings and revert the graph to system defaults.
   • Adds a Customize Nodes control on the Asset Graph page that lets practitioners select an adapter and field whose value becomes the node label for each asset type (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ device owner name or email address).

   2 more in Everything

6. docs update Oct 10, 2026 · issue 101

   Axonius adds UI-based import/export of saved queries as JSON files, preserving folder structure across environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Migrate a set of custom queries from a staging Axonius environment to production, preserving their folder hierarchy.
   📍1. In the staging environment, go to the Query Table and select the queries to migrate. 2. From the action menu, choose Export Queries — a JSON file downloads to your local machine. 3. In the production environment, click Import above the Query Table. 4. In the browse dialog, navigate to the downloaded JSON file and click Open. 5. The queries and their full folder structure are created; if a folder already exists the queries land inside it.
   • Adds Export Queries action in the query table action menu to download one or more saved queries (plus their folder structure) as a JSON file to your local machine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Import button above the Query Table to load a previously exported query JSON file, auto-creating missing parent folders and overwriting same-named queries.
   • Imported queries automatically inherit the privacy status (Private, Public, or Shared) of their destination folder, preventing accidental exposure of sensitive queries.
   • Requires the Export Queries, Import Queries, and Add or edit query permissions on an unrestricted role to use either capability.
   • Supports moving queries between Axonius environments; import and export are coupled to the UI flow — queries exported via API cannot be imported through this feature, and vice versa.

   5 details in Everything

7. docs update Oct 10, 2026 · issue 101

   Axonius adds hierarchical query folder management with archiving, drag-and-drop moves, and permission-aware organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Archive stale queries so they stop appearing in new chart/report pickers without breaking existing dashboards.
   📍On the Queries page: 1. Select one or more saved queries. 2. Open the More Actions menu and choose Move To Folder. 3. Select Archive from the folder list and click Move. 4. Confirm the warning that the query will no longer be available in new Charts, Enforcement Actions, Reports, or Queries. The query name is prefixed with (Archived) and remains active in existing configurations.
   Bulk-move a set of private queries into a shared public subfolder as a team takes over ownership.
   📍On the Queries page: 1. Select one or more queries in My Private Queries. 2. Open More Actions and choose Move To Folder. 3. Navigate to the target public subfolder using the scrollbars and click Move. 4. Confirm the permission-change prompt — the queries become public and visible to all Data Scope users.
   • Adds a collapsible folder pane on the Queries page to organize saved queries into nested folders up to 5 levels deep.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Provides default system folders — All Queries, Shared Queries, Predefined Queries, My Private Queries, Asset Scope Queries, and Archive — each with distinct access and editability rules.
   • Enables creating, renaming, and deleting custom folders via a 3-dot context menu on any user-created folder.
   • Supports moving queries to a different folder via More Actions > Move To Folder with automatic permission promotion (private-to-public) and confirmation prompts.
   • Introduces an Archive folder that removes queries from new chart, enforcement action, report, and query selection while keeping them functional in existing configurations.

   5 details in Everything

8. docs update Oct 10, 2026 · issue 101

   Axonius adds a Text dashboard widget with Markdown support, rich formatting, and hyperlink navigation to internal or external URLs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Add a Text widget to a dashboard that links analysts directly to a specific Case Management page, creating a guided workflow hub.
   📍In the Dashboard editor, click Add Widget › select Text from the Widget drop-down. Type your label text (e.g., Open Cases), select it, click the hyperlink icon in the formatting toolbar, enter the relative path /case_management, and click Save.
   Use Markdown to structure a dashboard section header and annotated bullet list without touching the formatting toolbar.
   📍In the Text widget edit pane, type: # Asset Inventory Summary - Review critical findings - Validate unmanaged devices Updated daily
   • Adds a Text widget for dashboards that supports Markdown syntax (headings #–######, **bold**, *italic*, ~~strikethrough~~, bullet lists with - or *, and ordered lists) with live conversion as you type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds clickable hyperlink support in Text widgets, distinguishing external paths (http:// or https://, opening in a new tab) from relative paths (interpreted against the Axonius instance URL for internal navigation).
   • Adds a Text widget to display static text, titles, or section dividers on dashboards with toolbar controls for size, color, bold, italics, and alignment, plus optional transparent background and chart title visibility.

   3 details in Everything

9. docs update Oct 10, 2026 · issue 101

   Axonius adds a Field Segmentation chart widget supporting histogram, pie, timeline, and table views with threshold coloring and CSV export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Track the trend of critical CVE counts across all devices over the last month, aggregated weekly, to spot spikes during the current sprint.
   📍Dashboard › Add Widget › Field Segmentation 1. Chart presentation: Timeline 2. Module: Devices, Query: (your critical-CVE query) 3. Segment by: CVE field 4. Data series: Individual segments (top 20) 5. Aggregate by: Week 6. Show results in the last: 1 Month 7. Click Save
   Visualize OS-type distribution across all managed devices and immediately surface any segment breaching a count threshold you care about.
   📍Dashboard › Add Widget › Field Segmentation 1. Chart presentation: Bar chart (histogram) 2. Module: Devices, Query: (leave empty for all entities) 3. Segment by: OS Type 4. Enable Set threshold colors and configure your asset-count thresholds 5. Set maximum segments to display: 20, enable Aggregate remaining segments as Others 6. Click the color palette dropdown › rainbow swatch for auto-color 7. Click Save
   Export the full segment breakdown — beyond the default 5 visible rows — to CSV for offline reporting or ticket creation.
   📍On the Field Segmentation chart panel: 1. Use the pagination button to confirm all segments are loaded 2. Click the export button to download the complete result list as a CSV file
   • Adds a Field Segmentation chart widget that segments asset query results by any chosen field, displayed as a histogram, pie chart, timeline, or table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Case-sensitive segmentation toggle so that string values differing only by case (e.g. JOHN, John, JoHn) are treated as the same or distinct segment.
   • Adds Set maximum segments to display option for bar charts (default 10, max 20), with an Aggregate remaining segments as 'Others' toggle to roll up overflow segments into a named bucket.
   • Adds Exclude Adapters field to omit specific adapter data sources from chart calculations.
   • Adds Use historical data and Compare results to a previous date toggles for querying and comparing point-in-time asset snapshots.

   +5 more show less

   • Timeline visualization supports Aggregate by periods (Day, Week, Month, Quarter, Year) and a configurable lookback window via Show results in the last (days, weeks, months or years).
   • Adds Duplicate Row button on each row of the Field Segmentation chart to clone an entire block or an individual inner row.
   • Supports export of the full segment result list to a CSV file via an export button.
   • Allows threshold colors via Set threshold colors to visually flag segments that meet or exceed specific asset count thresholds.
   • Supports automatic rainbow color palette assignment to bar chart segments.

   10 details in Everything

10. docs update Oct 10, 2026 · issue 100
    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Accelerate stale device removal during healthy fetches while keeping a safety net for failing connections — set the fast-cutoff to match your discovery schedule and the slow-cutoff to a longer window.
    📍In the Axonius console, go to Adapters › [your adapter] › Advanced Settings. Set 'Delete devices and other assets that have not been returned from the source in the last X hours' to 12 (matching your 12-hour discovery schedule), and confirm 'Delete devices that have not been returned from the source in the last X hours' is set to a higher value (e.g. 48). Optionally, override these values per individual connection under the connection's own Advanced Settings.
    Keep user records lean during normal operations but retain them longer if a connection goes silent — configure the user fast-cutoff lower than the slow-cutoff.
    📍In the Axonius console, go to Adapters › [your adapter] › Advanced Settings. Set 'Delete users that have not been returned from the source in the last X hours' to 6, and confirm 'Delete users that have not been returned from the source in the last X hours' (slow cutoff) is set to 24 or higher.
11. docs update Oct 9, 2026 · issue 098

    Axonius Asset Graph now displays risk level indicators for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. applications, viewable via the Layers panel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Show or hide SaaS application risk level icons on the Asset Graph to quickly spot high-risk applications in your environment.
    📍In the Asset Graph, open the Layers panel and toggle the risk indicator on or off to show or hide low, medium, and high risk icons on SaaS application nodes.
12. docs update Oct 9, 2026 · issue 098

    Axonius Asset Graph gains Organic and Hierarchical layout options to clarify relationship visualization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Switch to Hierarchical layout in the Asset Graph to clearly visualize parent-child or organizational asset relationships.
    📍In the Asset Graph, click the layout button in the lower-left corner, then select Hierarchical. Expand Relationships on any asset — nodes will be arranged in levels reflecting their organizational hierarchy.
    • Adds two selectable layout modes to the Asset Graph — Organic (default, for complex non-hierarchical relationships) and Hierarchical (for parent-child and tiered structures) — accessible via the layout button in the lower-left corner of the Asset Graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

13. docs update Oct 9, 2026 · issue 098

    Axonius Asset Graph gains Explore Relationships drawer, unrelated-asset filtering, and custom relationship creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Hunt for unmanaged devices by finding all Cisco device assets that have no connection to any user asset.
    📍1. In the Asset Graph, click the Cisco device node. 2. Select Explore Relationships. 3. Under Select asset types, choose Users. 4. Click Advanced Options. 5. Under Select a relationship, choose Last used by. 6. Under the related/unrelated toggle, select Unrelated. 7. Click Explore. The graph displays Cisco devices with no associated user.
    Inspect exactly which adapters contribute data to a single asset to diagnose correlation gaps.
    📍1. In the Asset Graph, click a single asset node. 2. Select Segment by entity. 3. Review the square adapter-connection icons — the number on each icon shows how many assets share that connection.
    • Adds the Explore Relationships drawer in the Asset Graph to show assets with specific relationships to a selected node, supporting asset types such as devices, software, tickets, and users, and relationships such as Relates to, Used by, Has, and Last used by.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Advanced Options section in the Explore Relationships drawer with a Select a relationship control, letting practitioners choose non-default relationships — including custom ones — for graph exploration.
    • Adds an Unrelated option (alongside the default Related) under Advanced Options to surface assets that have no connection to the selected asset, enabling discovery of unmanaged assets.
    • Adds Filter Results in the Explore Relationships drawer to apply filter criteria and refine which assets appear in the Asset Graph (available when exactly one asset type is selected).
    • Adds support for custom relationships, allowing practitioners to define their own connections between assets of different types or the same type.

    +1 more show less

    • Adds Segment by entity action on a single asset node to view that asset's individual adapter connections, shown as square icons with connection counts.

    6 details in Everything

14. docs update Oct 9, 2026 · issue 098

    Axonius adds saved filters for dashboards, enabling per-user sticky filter views and system-default filters across all charts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Give each regional team a personalized dashboard view by creating a region-scoped saved filter and setting it as the default — without duplicating the dashboard.
    📍1. Open the target dashboard. 2. Click Saved Filters › New Filter. 3. Enter a name in Filter Name (e.g. EMEA Region). 4. Under Asset, select the asset type and set the geographic filter parameters. 5. Click Apply to save and activate the filter. 6. To make it the team default: click Saved Filters, hover over the new filter, open the 3-dot menu, and select Set as System Default.
    • Adds Saved Filters to dashboards, letting users create named filters scoped to an asset type that apply automatically to every chart in the dashboard simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the ability to set a System Default saved filter per dashboard via the 3-dot menu > Set as System Default, giving teams a consistent starting view without overriding individual user selections.
    • Saved filters are sticky per user — a selected filter persists across navigation sessions without requiring re-configuration each visit.
    • Saved filters can now be referenced when configuring reports, independently of the filter applied to the source dashboard.
    • Multiple users can view the same dashboard simultaneously, each with a different saved filter applied.

    +2 more show less

    • Saved filters combine with any existing per-chart filters, allowing layered filtering at both dashboard and chart level.
    • Chart Wizard previews within a filtered dashboard now reflect the active dashboard-level saved filter, visible in the preview query.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !After upgrading to version 7.0.9 or higher, dashboards not viewed within 30 days of migration may need to be manually refreshed to show the latest data; a prompt will appear.
    • !After 30 days post-upgrade, any dashboard with a saved filter applied that has not been viewed in 60 days may also require a manual refresh.
15. docs update Oct 9, 2026 · issue 098

    Axonius adds a Dashboard Manager page for centralized dashboard administration, folder organization, bulk export, and Data Scope Defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Set organization-wide default dashboards so all new users in a data scope land on the right views automatically.
    📍In Axonius, go to Dashboards › Dashboard Tools › Dashboard Manager. Select one or more dashboards in the table, click More Actions at the top right, choose Data Scope Defaults, then click Add to Data Scope Defaults.
    Bulk-export all dashboards in a folder for backup or migration to another data scope.
    📍In Dashboard Manager, locate the target folder in the left Folders pane, click the 3-dot menu next to the folder name, then click Export.
    Audit which roles can see a sensitive dashboard and restrict access before a pentest engagement.
    📍In Dashboard Manager, hover over the dashboard row and click Edit. Under Role Permissions, set sensitive roles to No Access or Viewer, then click Save.
    • Introduces the Dashboard Manager page, a centralized table for creating, editing, deleting, searching, and filtering all dashboards across the system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Organizes dashboards into permission-based folders: All Dashboards, Favorites, Data Scope Defaults, Public, Shared, Private, and Managed by Axonius, with support for subfolders under Public, Shared, and Private.
    • Adds per-dashboard role permission controls with four levels: No Access, System Access, Viewer, and Editor.
    • Enables bulk export of multiple dashboards at once (limited to Public and Shared dashboards), including folder-level bulk export via the 3-dot folder menu.
    • Adds Data Scope Defaults assignment, allowing users with the Set Data Scope Defaults permission to define dashboards that appear in the Favorites folder for all new users in a data scope.

    +2 more show less

    • Exposes table columns including Access, Role Permissions, Charts, Created By, Last Modified, Date Created, Last Viewed, and Folder Path for dashboard inventory visibility.
    • Supports filtering the dashboards table by Access, Role Permissions, Created By, and Folder Path, with Select All, Clear All, and Reset controls.
    • Introduces the Dashboard Manager page, a centralized table for creating, editing, deleting, searching, and filtering all dashboards across the system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Organizes dashboards into permission-based folders: All Dashboards, Favorites, Data Scope Defaults, Public, Shared, Private, and Managed by Axonius, with support for subfolders under Public, Shared, and Private.
    • Adds per-dashboard role permission controls with four levels: No Access, System Access, Viewer, and Editor.
    • Adds Data Scope Defaults assignment, allowing users with the Set Data Scope Defaults permission to define dashboards that appear in the Favorites folder for all new users in a data scope.
    • Exposes table columns including Access, Role Permissions, Charts, Created By, Last Modified, Date Created, Last Viewed, and Folder Path for dashboard inventory visibility.

    +1 more show less

    • Supports filtering the dashboards table by Access, Role Permissions, Created By, and Folder Path, with Select All, Clear All, and Reset controls.

    1 more in Everything

16. docs update Oct 9, 2026 · issue 098

    Axonius: Supports exporting one or more Asset Graphs simultaneously to a single JSON file, saveable to any local or network location.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Share a curated Asset Graph with a teammate or back it up to a network share by exporting it from the loaded graph view.
    📍1. Open a saved Asset Graph in Axonius. 2. Click the three-dots menu on the graph. 3. Select Export — a JSON file containing the graph is downloaded. 4. Save the JSON file to a shared repository folder or network location.
    Re-use Asset Graphs from another Axonius instance by importing a previously exported JSON file into the Graphs list.
    📍1. In the Asset Graph Manager, click the import button above the upper-right corner of the Graphs list. 2. Select the JSON file containing one or more exported graphs. 3. Click Open — each graph in the file is added individually to the Graphs list.
    • Supports importing one or more Asset Graphs from a JSON file, with each graph created individually in the Graphs list.

    1 detail in Everything

17. docs update Oct 9, 2026 · issue 098

    Axonius adds an Asset Graph Manager page for saving, organizing, duplicating, and managing asset graphs across folders and roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Organize investigation graphs by team or scope — move a set of asset graphs into a dedicated folder in one action.
    📍1. In Asset Graph Manager, select one or more graphs in the Graphs table. 2. Click the actions menu at the top-right of the table and select Move to Folder. 3. In the Search Folders dropdown, type part of the destination folder name. 4. Click the destination folder, then click Move.
    Reuse an existing investigation graph as a baseline for a new one without rebuilding it from scratch.
    📍1. In Asset Graph Manager, find the graph to copy in the Graphs table. 2. Open the details drawer and click Duplicate (or select the graph and choose Duplicate from the 3-dot menu). 3. In the drawer, replace Copy of <original name> with a descriptive name and adjust tags. 4. Click Create to save the new graph.
    • Adds the Asset Graph Manager page, accessible via Manage Asset Graphs in the upper-right corner of the Asset Graph page, for centralized management of all saved asset graphs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Folders pane to the Asset Graph Manager with built-in folders (All Graphs, Favorites, Public, Private) plus support for creating, renaming, deleting, and nesting custom folders under Public or Private (requires Manage dashboard folders permission).
    • Adds a Graphs table displaying per-graph metadata: Name, Description, Investigation Steps (with hover-popup of steps), Tags, Access, Role Permissions, Module, Created By, Date Created, Last Updated, and Last Used By.
    • Adds search and filter capabilities across all table columns plus an additional Search in Investigation Steps field, with a Reset button to clear all filters.
    • Adds a details drawer for viewing and editing asset graph Name, Description, Access, and Tags inline, saving via Update.

    +3 more show less

    • Adds graph duplication — creating a copy pre-named Copy of <original> with editable name and tags before saving via Create.
    • Adds Favorites management, allowing graphs to be starred individually or in bulk via Add to Favorites / Remove from Favorites actions.
    • Adds Move to Folder bulk action with a searchable Search Folders dropdown to relocate one or more asset graphs.

    8 details in Everything

18. docs update Oct 9, 2026 · issue 098

    Axonius adds faster asset and user deletion settings for active connections, with per-connection or per-adapter granularity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Expire stale devices quickly during healthy fetches (e.g. 12-hour fast cutoff) while keeping the standard 48-hour safety net for failing connections.
    📍In the Axonius adapter Advanced Settings, set 'Delete devices and other assets that have not been returned from the source in the last X hours' to 12, and confirm 'Delete devices that have not been returned from the source in the last X hours' is set to 48. Apply at the adapter level or override per connection.
    Expire stale users quickly during healthy fetches (e.g. 6-hour fast cutoff) while keeping the standard 24-hour safety net for failing connections.
    📍In the Axonius adapter Advanced Settings, set 'Delete users that have not been returned from the source in the last X hours' to 6, and confirm 'Delete users that have not been returned from the source in the last X hours' is set to 24. Apply at the adapter level or override per connection.
    • Adds a new 'Delete devices and other assets that have not been returned from the source in the last X hours' fast-cutoff setting that deletes devices sooner when a connection is fetching successfully, independently of the standard deletion window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a new 'Delete users that have not been returned from the source in the last X hours' fast-cutoff setting that deletes users sooner when a connection is fetching successfully, independently of the standard user deletion window.
    • Both fast-cutoff settings can be configured globally for all connections on an adapter or overridden per individual connection, and each must be set to a value lower than its corresponding standard deletion threshold.
    • Adds a new 'Delete devices and other assets that have not been returned from the source in the last X hours' fast-cutoff setting that deletes devices sooner when a connection is fetching successfully, independently of the standard deletion window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a new 'Delete users that have not been returned from the source in the last X hours' fast-cutoff setting that deletes users sooner when a connection is fetching successfully, independently of the standard user deletion window.

    1 more in Everything

19. docs update Oct 6, 2026 · issue 096

    Axonius adds Dynamic Value statements to Enforcement Actions, enabling asset-driven field population with All and Switch/Case logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Tag users differently based on their country field — without writing a separate Enforcement Set for each value — using a Switch/Case Dynamic Value statement on the Add Tag to Assets action.
    text copy

    switch user.specific_data.data.user_country
    case field_equal ("United States") then form.tag_name set_value "US"

    Count only the CVE severities that survive data refinement (e.g. low only) when populating a custom asset field, by using the count function inside an All statement with Ignore Empty Values on Asset Fields enabled.
    text copy

    device all then form.field_integer set_value count ([device.specific_data.data.hostname])

    Stop a Create User Enforcement Action entirely — rather than proceeding with a meaningless fallback — when dynamic value processing fails, by enabling the 'Fail the action if dynamic values fail' setting via the Settings icon next to the Configure Dynamic Values toggle.
    📍In the Enforcement Action dialog, enable Configure Dynamic Values › click the Settings icon › enable 'Fail the action if dynamic values fail'.
    • Adds the Configure Dynamic Values toggle to Enforcement Actions, enabling Dynamic Value statements that populate action fields with values drawn from the assets themselves.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces two statement types: All statements (iterate every asset and populate action fields) and Switch/Case statements (evaluate an asset field against multiple criteria to set field values).
    • Adds Ignore Empty Values on Asset Fields setting (enabled by default) so null entries in multi-value fields are skipped instead of failing the statement.
    • Adds Fail the action if dynamic values fail setting (disabled by default) to halt and log an Enforcement Action as Failed instead of falling back silently when dynamic value processing errors occur.
    • Provides a Dynamic Value Statement Wizard and Syntax Helper with autocomplete for building statements interactively inside the Enforcement Action dialog.

    +4 more show less

    • Provides a Dynamic Value Statement Simulator to debug statements component by component before a live run.
    • Supports HTML and Plain Text editors within Dynamic Value statements for Enforcement Actions that include a custom message field (such as Axonius - Send Email).
    • Dynamic Value statements respect data refinement configuration — null values filtered from list fields are automatically excluded from functions such as count.
    • Dynamic Value statements support asset, Activity Logs, and Adapters Fetch History modules; Asset Investigation and Findings modules are not supported.

    9 details in Everything

20. docs update Oct 6, 2026 · issue 096

    Axonius adds a Repeat For Each workflow node that loops over assets in a single workflow run, reducing resource usage versus per-asset execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Process all devices returned by a query inside a single workflow run rather than launching one run per device.
    📍In the workflow builder, after any existing node hover over the + and click Repeat For Each. In the configuration drawer, select Run on Assets, click Select assets using the Query Wizard, build a query for the target devices, then click Apply. Add action nodes inside the loop branch to operate on each device.
    Loop over an array field (e.g. IP addresses) produced by an upstream action node rather than iterating over whole assets.
    📍In the workflow builder, after the upstream action node hover over the + and click Repeat For Each. In the configuration drawer, click Run on internal list object, then An asset from a previous node. In 'Available asset to run on from previous nodes' select the upstream node, in Available list from the chosen asset select the array field (e.g. IP addresses), then click Apply.
    • Adds a Repeat For Each node to workflows that processes multiple assets in a single workflow run instead of spawning a separate run per asset, reducing resource consumption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports looping over assets from a Query Wizard query, resolved assets from a previous node via the Run on resolved assets from previous nodes selector, an array field from a non-Variable upstream node via Run on internal list object, or a list from a Variable node via Previous variable node.
    • Adds an Exit Repeat node to break out of a Repeat For Each loop early, returning execution to the main workflow branch.
    • Supports nesting Repeat For Each nodes, allowing inner loops to iterate over sub-entities within each outer loop iteration.
    • Adds per-node testing for Repeat For Each nodes via Run Test, which resolves and displays entities (Entities Resolved (N) for asset loops or Array Values (N) for array loops) and lets you select a single entity as the iteration context for testing downstream nodes.

    5 details in Everything

21. docs update Oct 6, 2026 · issue 096

    Axonius adds a Query node to workflows, enabling dynamic asset lookups across Users, Devices, and Software without changing the trigger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Look up all devices belonging to a user identified in an upstream Event node, then act on each matching device in a foreach loop.
    📍1. In the workflow canvas, click + to add a node after your trigger. 2. Select Query from the node type list. 3. In Name, enter User Devices. 4. Under Define the query expression, click Custom. 5. From the Module dropdown, select Devices. 6. In the Query Wizard, set the filter field to user_id and in the Field Value box, open the Workflow Data dialog to copy the USER_ID value from the upstream Event node. 7. Click View Query Results to validate the filter returns the expected devices. 8. Click + Add downstream node and select a foreach action to process each returned device.
    Combine two independent device queries in one node so downstream conditions operate on the union of active and at-risk devices.
    📍1. Click the Query node to open its configuration drawer. 2. Configure the first query: click Custom, select Devices, set filter status = active, name it Active Devices. 3. Click + Add to add a second query tab. 4. Configure the second query: click Custom, select Devices, set filter risk_level = high, name it At-Risk Devices. 5. Click Run Test — the Test Results panel shows two tabs: Active Devices (N) and At-Risk Devices (N). 6. Downstream nodes receive the ORed union of both result sets.
    • Adds a Query node to Axonius workflows that dynamically fetches assets (Users, Devices, Software) using saved or custom queries, combining multiple query results via OR logic for downstream processing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports dynamic field values in query filters via the Workflow Data repository, letting values from upstream nodes drive query conditions at runtime.
    • Provides a Run Test action on the Query node that surfaces per-query asset counts and a View Query Results link into the Assets view for validation without leaving the configuration drawer.
    • Enables bulk operations when a Query node is placed at the start of a workflow followed by an action, allowing large asset sets to be processed in a single automation.

    4 details in Everything

22. docs update Oct 6, 2026 · issue 096

    Axonius Workflows gain Nested Loop support via Repeat for Each node, enabling sequential multi-asset processing within a single run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enforce software-approval policies by looping over unapproved apps and then over each user with access — consolidating a final report in the main Workflow path after both loops complete.
    📍In the Workflow canvas: 1. Add a query trigger for all unapproved/unmanaged applications. 2. Below the trigger, click Repeat for Each to add the outer loop node; in its configuration select Select Asset Using the Query Wizard and define the unapproved-apps query, then click Apply. 3. In the right (Nested Loop) branch, click Repeat for Each again for the inner loop; select 'Run action on resolved assets from previous nodes' and choose users with access. 4. Inside the inner loop, add an Action node to message each user, then a Condition node to remove the app or do nothing based on their reply. 5. In the left (main Workflow) branch after the outer loop, add an Action node to send a consolidated report on all blocked apps.
    • Supports two asset-selection methods inside Repeat for Each: resolved assets from previous nodes (via the Run action on resolved assets from previous nodes dropdown) or a custom query built with the Query Wizard.
    • Supports nesting one Repeat for Each node inside another, enabling multi-layered iteration for complex, multi-entity automation tasks.
    • Nodes within a Nested Loop can access the data bank of the parent Workflow, but data generated inside a Nested Loop is scoped to that loop and not accessible by the parent or sibling nodes.
    • Allows Repeat for Each to be placed immediately after a manual or scheduled Workflow trigger to iterate over the initial data set from the start.

    4 details in Everything

23. docs update Oct 6, 2026 · issue 096

    Axonius workflows gain an Exit node to terminate execution early on failed conditions or within loops.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Add a fail-safe brake to a risky workflow — stop the entire run immediately if a preliminary Query finds no assets before any destructive actions execute.
    📍1. In your workflow, hover over the + icon after a Query node. 2. Select Exit. 3. Configure the preceding Condition branch to route to the Exit node when the Query returns 0 assets. 4. The workflow terminates at that point; no further nodes execute.
    Stop a Repeat For Each loop as soon as a target item is found, then let the rest of the workflow continue outside the loop.
    📍1. Inside a Repeat For Each block, hover over the + icon at the point where you want early exit. 2. Select Exit Repeat. 3. Configure the preceding Condition to route to Exit Repeat when the target condition is met. 4. The loop halts; execution resumes at the first node after the Repeat For Each block.
    • Adds an Exit node to workflows that immediately terminates the entire workflow run when specific conditions are met (e.g., a Query returns 0 assets or a prior User Response was Deny).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Exit Repeat node (available when the Exit node is placed inside a Repeat For Each loop) that stops the current loop and resumes execution at the first node following the loop block, including support for nested Repeat For Each loops.

    2 details in Everything

24. docs update Oct 6, 2026 · issue 096

    Axonius Workflows gain Variable nodes for dynamic data storage, scoped lifecycle control, and cross-run persistence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Accumulate vulnerability hostnames across a For Each loop into a single report variable without mixing per-asset results.
    📍In the Workflow canvas, click + and add a Variable node inside a Repeat For Each loop. In the Write to Workflow Data drawer, set Variable name to device_hostname, Variable scope to Local, Field type to Multiple Values, enable Append values if field exists, and Value type to String. Reference the value downstream with [Variable.device_hostname].
    Persist a workflow-wide counter across runs so downstream ticketing nodes can reference the cumulative total from previous executions.
    📍In the Workflow canvas, click + and add a Variable node on the main branch. In the Write to Workflow Data drawer, set Variable name to run_counter, Variable scope to Global, Field type to Single Value, and Value type to Integer. In any downstream node, reference it with [Variable.run_counter].
    Store a complex formatted table structure for reuse in a ticket body across conditional branches.
    📍In the Write to Workflow Data drawer, set Variable name to ticket_body, Variable scope to Global, Field type to Single Value, and Value type to Object. Define the value using the Syntax tab with a Dynamic Value Statement. Reference it in the ticket action node with [Variable.ticket_body].
    • Adds Variable nodes to Workflows, introducing a Write to Data Repository node where practitioners can define, update, and store typed variables (String, Date, Float, Integer, Boolean, Array, Object) for use across nodes in the same Workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports Global and Local variable scopes within Workflows, with Local scope isolating each iteration of a Repeat For Each loop to prevent data accumulation across iterations.
    • Enables cross-run data persistence by saving variable values to the Workflow Data repository, so values captured in one run remain accessible in future runs regardless of asset path.
    • Supports referencing variables in Dynamic Value Statements using the [Variable.var_name] syntax, with autocomplete listing in-scope variables first.
    • Enforces a maximum of 10 variables per Variable node, with build-time validation rejecting duplicate variable names within the same scope.

    +2 more show less

    • Supports Multiple Values field type on variables, with an Append values if field exists checkbox to either append or overwrite existing values.
    • Structured value types Array and Object are available on Variable nodes, enabling storage of lists and JSON-like nested data for use in reports, ticket bodies, and rich email content.

    7 details in Everything

25. docs update Oct 6, 2026 · issue 096

    Axonius workflows gain a Delay node to pause execution for minutes, hours, or days (up to 30 days) before proceeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Space out remediation enforcement actions to avoid overwhelming systems by inserting a delay between steps.
    📍In the workflow canvas: 1. Hover over the + (plus) button where you want to insert a pause. 2. Select Delay from the node type list. 3. In the Delay for field, enter 2 and select hours from the dropdown. 4. Save and activate the workflow.
    Add a follow-up verification check after a remediation action by waiting 24 hours before the next node runs.
    📍In the workflow canvas: 1. After your remediation action node, hover over the + button. 2. Select Delay. 3. Set Delay for to 24 and choose hours. 4. Connect the next verification node after the Delay node.
    • Adds a Delay node type to the workflow canvas that pauses execution for a configured period (minutes, hours, or days) before proceeding to the next node, with a maximum of 30 days.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports per-iteration delays when a Delay node is placed inside a For Each loop, so each asset waits independently rather than the whole workflow waiting once.
    • Displays delay configuration details — time, unit, node reference ID, and node status — in the workflow run panel for visibility into when delays occur.
    • Adds a Delay node type to the workflow canvas that pauses execution for a configured period (minutes, hours, or days) before proceeding to the next node, with a maximum of 30 days.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports per-iteration delays when a Delay node is placed inside a For Each loop, so each asset waits independently rather than the whole workflow waiting once.

    1 more in Everything

26. docs update Oct 6, 2026 · issue 096

    Axonius: Adds Action Conditions node to Axonius Workflows, enabling IF/ELSE IF/ELSE branching based on Action outcomes or earlier node data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Route a workflow to an error-handling branch when a user-deactivation action fails, and continue normally when it succeeds.
    📍In the Workflow canvas, add an Action Conditions node after your deactivation Action node. In the Action Conditions pane, enable Condition based on action result and select Success from the dropdown. Add remediation nodes under the true branch and error-handling nodes under the after branch. Click Run Test to verify the Test Panel shows Action status: Success and Condition Matched.
    After disabling a user account, verify the user still meets high-risk criteria before escalating — only escalate if the asset still matches the query.
    📍In the Action Conditions pane, enable Condition based on asset criteria. Under that section, select Use an existing query and choose your predefined high-risk-users query. Add an escalation Action node under the true branch. Click Run Test; the Test Panel will show Query used, Tested on, and Condition Matched or Condition Not Matched.
    Branch workflow logic on a workflow variable — for example, escalate only when a failed-login counter exceeds a threshold.
    📍In the Action Conditions pane, enable Condition is based on data repository. Paste Variable.failed_login_count into the Input field, select > from the Func dropdown, and enter 3 in the Field Value textbox. Add an escalation node under true and a logging node under after. Use ELSE IF on the after branch to add a second condition for Variable.account_status Equals inactive.
    • Supports Condition based on action result sub-type, routing the workflow along the true or after branch depending on whether the preceding Action returned Success or Failure.
    • Supports Condition based on asset criteria sub-type, evaluating resolved assets against a Query Wizard-built or predefined query to decide which branch executes.
    • Supports Condition is based on data repository sub-type, checking variables from the Workflow Data repository using operators including Equals, Contains, Does not contain, Starts with, Ends with, Regex match, >, and <.
    • Enables complex multi-branch logic by chaining ELSE IF and ELSE nodes on the after branch, with ELSE executing only when all preceding IF/ELSE IF conditions fail.
    • Adds node-by-node testing for Action Conditions via Run Test, displaying Action status, Tested on, Condition type, Query used, Query results, Data evaluated, and Condition statement in the Test Panel.

    +1 more show less

    • Allows any of Add Action, Add Event, Add Delay, or Repeat for Each nodes to be placed beneath true and after branches of an Action Conditions node.

    6 details in Everything

27. docs update Oct 6, 2026 · issue 096

    Axonius: Adds Event Conditions node to Axonius Workflows, enabling IF/ELSE IF/ELSE branch logic that routes execution based on the outcome of a preceding Event node.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Route a workflow differently when a Workday new-hire event targets an inactive account — the true branch triggers remediation, the after branch continues normal onboarding.
    📍In the Workflow canvas, after your Workday New Hire Event node: 1. Hover over the + icon and add an Event Conditions node. 2. Enable Condition based on event criteria. 3. Set Select Field = Hire Date, Func = Equals, Field Value = current year. 4. Under the true branch, add an Add Action node for remediation. 5. Under the after branch, add the normal onboarding Action node.
    Pause a workflow branch until an approval event fires, then handle the timeout case separately if no approval arrives within the configured window.
    📍In the Workflow canvas, after a non-triggering Event node configured with a Timeout setting: 1. Add an Event Conditions node. 2. Select Timeout condition (note: this disables Fields condition). 3. Under the true branch (Event Timed Out), add an Add Action node to notify the security team. 4. Under the after branch, add the normal post-approval Action node.
    Build ELSE IF logic to handle three risk tiers — high, medium, and default — using Workflow Data repository variables.
    📍In the Workflow canvas, after an upstream node that sets risk variables: 1. Add an Event Conditions node; enable Condition based on data repository. 2. Paste Variable.risk_score, set Func = '>', Field Value = 80 (IF high risk). 3. On the after branch, add an Else IF Event Conditions node; set Variable.risk_score › 50. 4. On that node's after branch, add an Else node for all remaining cases.
    • Adds Condition based on data repository setting on the Event Conditions node, allowing conditions to reference any variable stored in the Workflow Data repository (e.g., Variable.failed_login_count > 3).
    • Adds Timeout condition sub-type on Event Conditions, branching to the true path when the preceding non-triggering Event node reaches its configured timeout without receiving a trigger.
    • Adds support for Previous Field Value comparison in Asset value changed event criteria, enabling conditions like 'status changed from Employed to Terminated'.
    • Adds Else IF and Else branch options on the after path of an Event Conditions node to build multi-stage conditional logic within a single Workflow.

    4 details in Everything

28. docs update Oct 6, 2026 · issue 096

    Axonius adds workflow import/export in JSON format for sharing automation across environments⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Share a tested workflow from a staging environment to production by exporting it as JSON and reimporting it.
    📍1. In the Workflows page, hover over the workflow you want to export. 2. Open the 3-dot menu and select Export Workflow. 3. Confirm the credentials-excluded warning and click Export — a JSON file downloads. 4. In the target environment, open the Create Workflow list and select Import Workflow. 5. Select the downloaded JSON file and click Open. 6. Resolve any conflicts using Save as copy or Overwrite, then click Import.
    • Adds Export Workflow action (3-dot menu on the Workflows page) to download a complete workflow definition as a JSON file, with credentials and sensitive inputs excluded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Import Workflow option under the Create Workflow list to load a JSON workflow file into any environment, with conflict resolution choices (Save as copy or Overwrite) for queries and data that already exist.

    2 details in Everything

29. docs update Oct 6, 2026 · issue 096

    Axonius Workflows gain bulk delete, bulk activate/deactivate, and per-workflow deactivation without deletion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Temporarily pause a Workflow during maintenance without losing its configuration — re-enable it when ready.
    📍1. Open the Workflow you want to pause. 2. In the configuration pane, toggle off Active. 3. Click Save. 4. To resume, toggle on Active and click Save (or Run to save and run immediately).
    Clean up multiple stale Workflows at once from the main Workflows page.
    📍1. Navigate to the Workflows page. 2. Select one or more Workflows from the All Workflows table. 3. Click Delete and confirm the permanent deletion in the prompt.
    • Supports bulk deletion of one or more Workflows directly from the All Workflows table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports deleting a single Workflow from its configuration page via the Delete Workflow button.
    • Enables activating or deactivating one or more Workflows in bulk from the All Workflows table.
    • Adds a per-Workflow Active toggle on the configuration page to activate or deactivate without deleting, preserving configuration for future use.

    4 details in Everything

30. docs update Oct 6, 2026 · issue 096

    Axonius adds the ability to terminate in-progress or pending Workflow runs mid-execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Stop a runaway or mistakenly triggered Workflow before all its Enforcement Actions complete — useful when you need to halt changes mid-flight without undoing already-completed Actions.
    📍In the Workflows page, click Run History › select the target Workflow run › open the action menu › select Terminate Task (enabled only when status is In progress or Pending).
    • Adds a Terminate Task option in the Workflow Run History menu to stop Running or Pending Workflow runs, with per-Action outcome states (Completed, Running (interrupted), Not started) preserved after termination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

31. docs update Oct 6, 2026 · issue 096

    Axonius adds a Workflow Run History page for diagnosing errors, analyzing performance, and monitoring automation activity across all Workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Diagnose a failed Workflow run by navigating to its step-by-step execution history and inspecting the node that errored.
    📍1. In Axonius New Navigation Experience, go to Action Center › Action Center Tools › Run History. 2. Filter by Status = Failed to isolate failed runs. 3. Click the row for the failed run to open the Run drawer. 4. In the Overview panel, locate the node shown in pink (Run Error) and click it to view its details, status, affected assets, and configuration in the Node Details panel.
    Investigate all runs for a single Workflow to find bottlenecks or recurring failures.
    📍1. Navigate to the main Workflows page. 2. Click the desired Workflow in the Workflows table. 3. On the Workflow summary page, click View Runs in the top-right corner. 4. The Run History - Workflows tab opens, pre-filtered to that Workflow. Use the From/To date filters to narrow to a specific time window.
    Review all Action Center automation history for a specific asset to audit enforcement activity.
    📍1. From the Run drawer, click the Affected Asset or Retrieved Asset link to open the Asset Profile page. 2. On the Asset Profile page, click the Enforcement Runs tab to see all enforcement set and Workflow runs associated with that asset.
    • Adds a Run History page accessible from the Action Center menu under Action Center Tools, displaying a table of all past Workflow runs with fields including Run ID, Trigger Type, Workflow Name, Triggered On, Structure, Status, Last Reported Activity, Start Date, and End Date.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables per-Workflow run history by clicking View Runs on a Workflow's summary page, automatically filtering the Run History - Workflows tab to that Workflow.
    • Adds a Run drawer with an Overview panel and a Node Details panel, showing step-by-step execution paths, node UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., affected assets, dynamic value configurations, and per-node statuses (Success, Failure, Not Triggered, Awaiting, Timed Out, Completed).
    • Supports filtering the Run History table by Workflow Name, Event Type, Action Type, Status, and date range (From/To).
    • Adds a Terminate Task action in the Run History page to manually stop an in-progress Workflow run.

    +2 more show less

    • Surfaces detailed run information for Repeat For Each nodes, including a Repeat For Each Runs Overview tab with columns Run ID, Triggered On, Run Status, Duration, Last Reported Activity, Start Date, and End Date.
    • Adds an Enforcement Runs tab on the Asset Profile page listing all Action Center activities — including enforcement set and Workflow runs — related to a specific asset.

    7 details in Everything

32. docs update Oct 6, 2026 · issue 096

    Axonius Workflows gain Event nodes with webhook config from the canvas, AXONIUSPARSER field parsing, per-node timeout with branching, and an Event Fields inspection table.

    • Adds Parse additional fields toggle on any Workflow Event node, enabling automatic parsing of a string field containing AXONIUSPARSER {"key1": "value1"} into key-value pairs accessible via Dynamic Value Statements in downstream Actions.
    • Adds Add Timeout toggle on non-triggering Event nodes, with configurable duration in seconds, days, weeks, or months (default 90 days), and a choice to branch via an Event Conditions node or terminate the Workflow run on timeout.
    • New integrationAdds per-Event webhook configuration accessible directly from the Workflow Event pane, exposing the predefined Webhook URL and signing secret for third-party integrations without navigating to System Settings.
    • Adds Event Fields button in the Event configuration pane, displaying a table of Field Name and Field Type for every field in the selected event to inform filter and condition authoring.
    • Supports configuring Workflow Events as either triggering nodes (from the Trigger Type pane) or non-triggering nodes (from the Event pane), with each node assigned a system-generated UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. for referencing in the Workflow Data repository.

    +1 more show less

    • Webhook settings for Workflow Events are also reachable via System Settings > External Integrations > Workflows, providing a central location to view and update URLs and signing secrets.

    6 details in Everything

    • New supported platform Workflow Event categories
33. docs update Oct 6, 2026 · issue 096

    Axonius adds CSV export for asset inventory pages with configurable splitting, delimiters, row limits, and an Exports Page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Export all vulnerable software assets with associated device hostnames so you can correlate CVEs to machines in a spreadsheet.
    📍1. Navigate to the Aggregated Security Findings Assets page. 2. Click Export CSV above the results table. 3. In the Export Data dialog, enable Include associated devices. 4. Under Device fields, keep Preferred host name selected (or click + to add more fields). 5. Set Split by field values to the desired vulnerability field (e.g. Tags). 6. Click Export. Monitor the snackbar at the bottom left; click View all exports when Your file is ready appears.
    Export a large device inventory while keeping complex adapter objects readable as JSON rather than exploded columns, and limiting output to the top 50000 rows for faster generation.
    📍1. Navigate to any Assets page and run your query. 2. Click Export CSV above the table. 3. In the Export Data dialog, enable Don't split complex objects into columns. 4. Set Maximum rows to 50000. 5. Optionally set Delimiter to use for multi-value fields to ',' to override the system default. 6. Click Export and retrieve the file from the Exports Page if the session closes before completion.
    • Adds Export CSV function on any Assets page to export query results or selected rows to a CSV file, with a default maximum of 1048500 rows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Split by asset entities option in the Export Data dialog to output each adapter-sourced entity as a separate row.
    • Adds Split by field values option to expand complex fields and lists (e.g. Installed Software, Tags) into separate rows per value.
    • Adds Don't split complex objects into columns option to render complex objects as a single JSON-formatted column instead of exploding them into multiple columns.
    • Adds Exclude parent complex objects columns option to hide parent field headers of complex fields in exported files.

    +5 more show less

    • Adds per-export Delimiter to use for multi-value fields setting, overriding the system-wide Export CSV delimiter to use for multi-value fields value in System Settings > GUI Settings (default: \n).
    • Adds Include associated devices option (for Software and Aggregated Security Findings exports) to append per-asset device fields, with Device fields selector defaulting to Preferred host name.
    • Adds Maximum rows setting (default: 1048500, the Excel row limit) to cap exported rows and improve generation time.
    • Adds an Exports Page where all completed Assets page exports can be viewed and re-downloaded across sessions.
    • Requires Export CSV permission and at least 15 GB of available disk space; exports fail with a prompt if disk space is insufficient.

    10 details in Everything

34. docs update Oct 6, 2026 · issue 096

    Axonius adds per-asset Dashboards tab to Asset Profiles, with cross-asset relationship charts and import/export in JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Visualize cross-asset relationships on a Device profile — e.g., see all Users connected to a specific device alongside Security Findings.
    📍1. Open an Asset Profile for a Device. 2. Select the Dashboards tab at the top of the page. 3. Click + › Create Dashboard. 4. Add a Query Comparison chart; set the target Asset Type to Users. 5. From the relationship dropdown, choose the specific relationship type (or accept the default). 6. Save — the chart auto-filters to the profiled device's unique ID.
    Move a dashboard from one environment to another Asset Profile of the same asset type.
    📍1. In the source environment, open the Asset Profile dashboard. 2. Click the 3-dot More Dashboard Menu › Export the Dashboard (saves as JSON). 3. In the target environment, open an Asset Profile of the same asset type. 4. Select the Dashboards tab › click + › Import Dashboard. 5. Select the exported JSON file; choose to overwrite or create a copy if a name collision exists.
    • Exports Asset Profile dashboards in JSON format via the More Dashboard Menu.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Dashboards tab to every Asset Profile page, providing auto-filtered charts scoped to the selected asset's unique ID.
    • Supports importing dashboards from file onto an Asset Profile page, with options to overwrite or copy on name collision (same asset type only).
    • Enables cross-asset relationship charts on Asset Profile dashboards — e.g., enriching a Device profile with connected Users, Security Findings, or Applications via a relationship dropdown.
    • Allows creating, duplicating, refreshing, editing, and deleting dashboards directly within an Asset Profile page, with the same permission model as standard Axonius dashboards.

    +1 more show less

    • Supports per-dashboard filtering on Asset Profile pages, with the asset's unique ID applied as a non-removable prefilter and additional filters scoped to the currently viewed asset.

    6 details in Everything

35. docs update Oct 6, 2026 · issue 096

    Axonius adds Expand Assets by Complex Field view to pivot asset tables around nested fields like Installed Software or Network Interfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Pivot the Devices table to list all installed software per device and filter down to a single vendor, for rapid software-exposure triage.
    📍1. Go to any Assets page (e.g., Devices). 2. Click Edit Table › Edit Columns and add Installed Software: Software Name and Installed Software: Software Vendor. 3. Click Edit Table › Expand Assets by and select Installed Software. 4. In the Query Wizard, add a filter for Installed Software: Software Vendor = Apache. 5. Next to that filter, click Refine Data › Refine value by condition to hide all other vendors from the expanded rows.
    • Adds Expand Assets by option under Edit Table in any Assets page, letting practitioners pivot the asset table so each row expands by a chosen complex field (e.g., Installed Software, Network Interfaces) instead of the default Adapter Connections view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports Refine Data filtering on expanded complex-field rows via the Query Wizard or the Refine Data Display dialog, allowing practitioners to isolate specific nested-field values (e.g., show only rows where Installed Software Vendor is Apache).
    • Enables saving expanded-asset views and queries — selecting Expand Assets by in the New View dialog persists the chosen complex field so every subsequent application of a Saved View or Saved Query re-expands by that field automatically.
    • Supports sorting expanded nested-field columns (ascending/descending) and exporting to CSV with complex fields split into separate rows via the Split by field value option in the Export Data dialog.
    • Adds Expand Assets by option under Edit Table in any Assets page, letting practitioners pivot the asset table so each row expands by a chosen complex field (e.g., Installed Software, Network Interfaces) instead of the default Adapter Connections view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports Refine Data filtering on expanded complex-field rows via the Query Wizard or the Refine Data Display dialog, allowing practitioners to isolate specific nested-field values (e.g., show only rows where Installed Software Vendor is Apache).
    • Enables saving expanded-asset views and queries — selecting Expand Assets by in the New View dialog persists the chosen complex field so every subsequent application of a Saved View or Saved Query re-expands by that field automatically.

    1 more in Everything

36. docs update Oct 6, 2026 · issue 096

    Axonius adds a full Asset Profile page with correlated adapter data, historical snapshots, custom field display, and saved views per asset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review raw unparsed adapter data for a device when triaging a discrepancy between what Axonius shows and what a source system reports.
    📍1. Open the Assets page and click a device row to open the Asset Profile drawer. 2. In the left pane, click Adapter Connections and select the relevant adapter connection. 3. At the top of the Adapter Connections table, click JSON to see all unparsed raw data returned by the adapter. 4. Click the copy icon to copy the JSON to the clipboard for offline comparison.
    Audit the state of a device on the date of a past incident without leaving the Asset Profile page.
    📍1. Open the full Asset Profile page for the target device (Actions menu › Open Device Profile). 2. Click Display by Date in the top-right corner above the Asset Profile table. 3. In the date picker, select the date of the incident. Only dates with collected snapshots are selectable. 4. Review all correlated adapter fields as they existed on that date.
    Set a team-wide default Asset Profile ID so every analyst sees the same identifying fields for devices across the system.
    📍1. Open any device's full Asset Profile page. 2. Hover over the profile title; click the Edit Asset Profile ID pencil icon. 3. From Title, select the field to use as the asset title. 4. From the two additional drop-downs, select two supplementary identity fields. 5. Click the arrow on Save Changes and select Set as System Default to apply to all users who have not set a personal override.
    • Adds the Asset Profile page and drawer, surfacing all correlated adapter data for any selected asset in a unified side-pane-plus-table layout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Display by Date control on the Asset Profile page, letting practitioners view daily snapshots of asset data for any historical date without returning to the asset table.
    • Adds JSON and XML Advanced View tabs on each Adapter Connections table to expose unparsed raw adapter data alongside the default table view.
    • Adds Edit Fields Display via the Edit Table button on the All Fields side-pane view, enabling admins to customize which fields appear system-wide and users to create personal saved views.
    • Adds Saved Views under Edit Table on the Asset Profile page, supporting per-user saved table configurations with default, share, edit, and delete options.

    +4 more show less

    • Adds Custom Data tab in the Asset Profile to display and manage per-asset custom fields added via Manage Custom Fields.
    • Adds customizable Asset Profile ID with a pencil-icon editor, allowing users to replace default identity fields and admins to Set as System Default across all users.
    • Adds Adapter Connections filtering and Common/Specific field-type filter within each adapter view, plus WMI Info adapter entry when Axonius - Run Windows WMI Scan has run against an Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. server.
    • Adds Tags side-pane section showing tag list, creation date, last-updated date, and expiration date, with inline Manage Tags to set colors and expiration.

    9 details in Everything

37. docs update Oct 6, 2026 · issue 096

    Axonius adds Data Refinement for Assets tables — filter columns, rows, and adapter connections without changing result counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Filter an Assets table column to show only specific adapter connections — useful when multiple adapters report the same field and you want to isolate one source.
    📍In the Assets table, click the icon on the right of a column header › open Refine field values by adapter connection › choose Include or Exclude from the dropdown › search for and select the target adapter or specific connection › click Apply.
    Apply data refinement across all columns at once — useful for configuring a saved query view and its CSV export in a single pass rather than column by column.
    📍In the Assets table, click Refine Data (next to the Edit Table button) › select a field and click Add › choose a refinement method and set filters › click '+' to add tabs for additional fields › click Apply to save.
    • Adds a Refine Data Display dialog (accessible via the icon on the right of each column header) to apply complex filter expressions to Assets table columns without affecting result counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Refine display by field value pane supporting AND/OR, NOT, field, operator, value, and parentheses controls to create multi-condition column filters, including on complex fields like Installed Software.
    • Adds Refine field values by adapter connection pane to include or exclude column values from specific adapter connections or individual connections.
    • Adds Refine asset entities by field value to hide or show entire asset entity rows based on field-value filter expressions.
    • Adds Refine asset entities by adapter connection to hide or show asset entity rows sourced from specific adapters or adapter connections.

    +2 more show less

    • Adds a table-level Refine Data dialog (next to the Edit Table button) to manage data refinement for all columns in a single view, with per-field tabs added via + and saved with Apply.
    • Data refinement settings propagate to CSV exports, including reports and Enforcement Actions that export data as CSV files.

    7 details in Everything

38. docs update Oct 6, 2026 · issue 096

    Axonius adds Saved Views for Assets and Adapter tables, with per-role sharing, role-based defaults, and admin-managed System Views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Lock in the most relevant columns for a SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analyst role so they see the right data automatically when opening any Devices Assets page.
    📍1. In an Assets table, click Edit Table. 2. Under Saved Views, select + New View, name it (e.g. SOC Analyst - Devices), and add the required columns from Available Columns. 3. Scroll to Who has access, expand it, and select the SOC Analyst role. 4. Expand Set view as default for and select the SOC Analyst role. 5. Click Save. Users with the SOC Analyst role will now land on this view automatically.
    Standardise the column layout across all users by updating the System View as an admin.
    📍1. In an Assets table, click Edit Table and hover over Saved Views. 2. Hover over System View and click Edit. 3. Add or remove columns as required in Available Columns / Displayed Columns. 4. Click Save. The updated System View becomes the new default for all users on that table.
    • Adds Saved Views to Assets tables, Adapter Connections page, and Adapters Fetch History page, letting each user create, name, and switch between custom column arrangements per asset type or adapter table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Set as Default option so a chosen view loads automatically when a user opens a specific Assets or Adapter table, with separate defaults configurable per table type.
    • Adds Expand Assets by setting when creating or editing a view, allowing rows to be expanded by a complex field.
    • Adds role-based view sharing via Who has access in the Edit View dialog, controlled by the Manage saved views permission, so admins and permitted users can share views with selected roles.
    • Adds admin-only ability to set any view as the default for specific user roles via Set view as default for under Who has access, automatically applying that view when users of the relevant role open the Assets page.

    +2 more show less

    • Adds admin-only editing of the System View (without renaming it), propagating a new system-wide default column arrangement to all users.
    • Supplies additional predefined views for Assets pages: System search (Host Name) (Default), System search (Last Used Users) (Default), System search (IP Address) (Default), and System search (Installed Software Name) (Default).

    7 details in Everything

39. docs update Oct 6, 2026 · issue 096

    Axonius introduces sub-assets: derived, filtered views of parent asset types with shared fields, queries, and permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enumerate only network infrastructure devices (routers, switches, firewalls) without building a manual saved query on the Devices page — navigate to the dedicated sub-asset page.
    📍In the Axonius console, go to Assets › Network Devices. The page automatically shows all devices where is_network_infra_device = true. Use the Query Wizard here to further filter by vendor or OS without affecting the parent Devices page.
    Scope an OT asset investigation to operational technology devices only, available when the Cyber-Physical Asset Management module is enabled.
    📍In the Axonius console, go to Assets › OT. The page surfaces all devices where device_classification_type = OT. Save queries here to keep OT-scoped searches separate from the broader Devices inventory.
    Review all CVEs aggregated across your environment in one place, grouped by unique CVE ID, to prioritize remediation without cross-referencing multiple finding sources.
    📍In the Axonius console, go to Assets › Vulnerabilities Repository. Each row represents a unique CVE, grouping all Aggregated Security Findings that share that CVE ID. Use the Query Wizard to filter by severity or affected asset count.
    • Adds is_network_infra_device = true as the derivation condition for the new Network Devices sub-asset page (Cyber Asset Management module).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds nat_translations field presence as the derivation condition for the NAT Rules sub-asset under Network/Firewall Rules.
    • Adds application_resource_type = repository as the derivation condition for the Repositories sub-asset under Application Resources.
    • Adds integration_type = Admin Managed filter for Admin Managed Extensions and Admin Managed Extension Instances sub-assets under Application Extensions and Application Extension Instances.
    • Adds integration_type = User Initiated filter for User Initiated Extensions and User Initiated Extension Instances sub-assets.

    +10 more show less

    • Adds integration_type = Add-on filter for Application Add-Ons and Application Add-On Instances sub-assets.
    • Adds integration_type = Application Key filter for the Application Keys sub-asset under Application Extension Instances.
    • Adds is_permission_adapter = true as the derivation condition for the Managed Identities sub-asset under Users (Identity Management module).
    • Adds is_latest = true as the derivation condition for the Rules sub-asset, surfacing only the latest version of each rule under Rules history.
    • Adds is_discovered = true as the derivation condition for the Discovered SaaS Applications sub-asset under SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Applications.
    • Adds device_classification_type = IoT, = IoMT, = OT, and = Network Inspector derivation conditions for four new Cyber-Physical Asset Management sub-assets: IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., IoMT, OT, and Network Inspectors.
    • Adds Software Registry sub-asset under Software, scoped to entries with an approval status source (manually approved or enriched through the software registry), available in the Cyber Asset Management Software Management module.
    • Introduces sub-assets as a platform concept: dedicated asset pages derived from a parent asset type and a field condition, requiring no separate adapter connection or data source.
    • Sub-asset pages support full Query Wizard query building and saving, with queries scoped to their sub-asset page and not shared with the parent page.
    • Sub-assets inherit role permissions from their parent asset type automatically, with no separate permission entry required.

    15 details in Everything

40. docs update Oct 6, 2026 · issue 096

    Axonius adds Alerts/Monitoring as a first-class asset type, centralizing monitoring alert data across Enforcement Center, Workflows, and Dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Find all High or Critical monitoring alerts currently open to prioritize immediate response.
    📍In Axonius, click the Assets icon › under Alerts/Monitoring select Cases (or in New Navigation: Inventory › All Assets › Tickets › Alerts/Monitoring). Open the Query Wizard, add a filter for Rule Severity = High or Critical, and add a second filter for Status = Open.
    Inspect which assets triggered a Critical monitoring alert by reviewing the Related Assets complex field in the alert profile.
    📍Click an alert row on the Alerts/Monitoring page to open its asset profile, then in the left pane under Tables click Related Assets to see Asset Name, Entity ID, and Asset Type for all related assets; hover over the count to preview the top 10.
    • Adds Alerts/Monitoring as a new asset type under the Assets menu, exposing monitoring alerts as standard Axonius assets queryable, filterable, and actionable across the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Surfaces alert fields including Alert ID, Rule Description, Trigger Date, Related Assets: Entity ID, Status, Monitoring Rule Name, Rule Severity, Rule Asset Type, Source, and Tags in the query results table.
    • Supports Status values (Open, In Progress, Closed, Canceled) and Rule Severity levels (Informational, Low, Medium, High, Critical) for filtering and querying monitoring alerts.
    • Enables single-alert and bulk actions on monitoring alerts directly from the Alerts/Monitoring page via the Asset Actions interface.
    • Exposes a Related Assets complex field in the alert asset profile showing asset name, entity ID, and asset type for related assets, with hover-to-preview for up to 10 additional assets.

    +2 more show less

    • Requires Alerts/Incidents assets and Findings permissions to access the Alerts/Monitoring page.
    • Integrates Alerts/Monitoring data into Enforcement Center, Workflows, and Dashboards for cross-platform use of alert data.

    7 details in Everything

41. docs update Oct 6, 2026 · issue 096

    Axonius adds a Network Connections tab on device asset profiles, visualising inbound/outbound connections by protocol and port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Investigate unexpected inbound traffic on a device by reviewing its protocol and port breakdown in the Network Connections tab.
    📍1. Go to the Devices asset page. 2. Select the device you want to investigate to open its asset profile. 3. Click the Network Connections tab. 4. Hover over a suspicious protocol or port (e.g. RTSP) to highlight only its connections. 5. Click a connected device node to navigate to that device's asset profile for further investigation.
    • Supports interactive node selection with blue-border highlighting that dims unrelated nodes, making it easier to trace specific communication paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports hover-to-highlight on a protocol or port entry to isolate only the connections using that protocol or port.
    • Supports click-through navigation from a connected device node directly to that device's asset profile.
    • Groups multiple devices of the same type sharing a protocol or port into a single expandable node showing a cumulative connection count.

    4 details in Everything

42. docs update Oct 6, 2026 · issue 096

    Axonius adds a Network Connections page giving consolidated visibility into asset-to-asset traffic, protocols, and connection types across IT, OT, and medical devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Identify all outbound connections from internal OT/medical assets to external destinations to support network segmentation review.
    📍In the Axonius console, go to Assets › Network › Network Connections. In the query builder, select Basic mode and add a filter: Connection Type = External-Outgoing. Optionally add a Protocol filter (for example, Modbus or DICOM) to narrow to industrial/medical traffic.
    Scope a network segmentation investigation to connections active within the last 7 days on a specific destination port.
    📍In the Axonius console, go to Assets › Network › Network Connections. In the query builder (Basic mode), add filters: Last Seen = within last 7 days AND Destination Port = 502 (Modbus). Use Edit Columns to surface Src. Device Model and Dest. Device Model for device-type context.
    • Adds the Network Connections page (Assets > Network > Network Connections) showing a consolidated view of all network connections between assets, with fields including Srce IP, Dest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ IP, Protocol, Source Port, Destination Port, Last Seen, Connection Type, Src. Device Model, and Dest. Device Model.
    • Classifies each connection via the Connection Type field into Internal, External-Incoming, or External-Outgoing categories to surface risky communication patterns.
    • Supports passive discovery of both standard IT protocols and industrial/medical protocols — including Modbus, DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems., and EtherNet/IP — via CPA Collectors connected to network switches over a SPAN port, with no agents or active scanning required.
    • Enables query filtering on the Network Connections page in Basic mode to isolate specific patterns such as external outgoing connections, connections by protocol or port, or connections by time range.
    • Adds per-device network connection graph view accessible from asset profiles (see Device Network Connection Graph).

    5 details in Everything

43. docs update Oct 5, 2026 · issue 095

    Axonius Pivot Chart gains editable number and date fields with formatting, short notation, value ranges, and date aggregation options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Configure a numeric asset count column in Pivot Chart to display abbreviated values (e.g. 1,500 as 1.5K) with two decimal places and a capped range.
    📍In the Pivot Chart, next to a number field click the Edit icon, then: set Field display name to your preferred label, enable Use short notation K/M/B and choose K for 1,000s, set Decimal places to 2, set Format to none, and set Value range min/max to filter outliers. Click Apply.
    Group date-based events by week in a Pivot Chart to track asset changes over rolling weekly periods.
    📍In the Pivot Chart, select a date field and click the Edit icon, set Field Display Name as desired, select Week as the aggregation (e.g. Jan 1-7, 2024), choose your preferred display format, and click Apply.
    • Adds number field editing in Pivot Chart, with options for field display name, short notation (K/M/B), decimal places, format (none, percentage, currency sign, or currency code), and value range (min/max filter).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds date field editing in Pivot Chart, supporting custom display names, aggregation levels (Hour, Hour in a day, Day, Day in a week, Week, Month, Quarter, Year), and selectable display format.

    2 details in Everything

44. docs update Oct 5, 2026 · issue 095

    Axonius adds multi-line timeline charts to the Pivot Chart widget with dimension-based and multi-measure modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Track device counts by OS type over the past 30 days to spot fleet composition trends on an Axonius dashboard.
    📍1. On an editable dashboard, click Add Chart. 2. In the Name field, enter Devices by OS Type - 30 Days. 3. From the Widget list, select Pivot Chart. 4. Under Visualization, select Line. 5. Under Data, select the Devices module and choose your query. 6. Under Schema, select Latest data. 7. Under Dimension Column, select Last Seen; set Aggregate by to Day. 8. Under Dimension Row, select OS: Type. 9. Under Metrics, select Assets with the Count function. 10. Click Save.
    Compare total device count, active devices, and devices needing updates on the same timeline to prioritise remediation work.
    📍1. Click Add Chart and name the chart. 2. Select Pivot Chart as Widget and Line as Visualization. 3. Under Schema, select Data over time (snapshots). 4. Under Dimension Column, leave as Data over time; set Aggregate by to Week. 5. Leave Dimension Row empty. 6. Under Metrics, click + Add to add each measure (e.g., total assets, active assets, assets needing updates); select Count for each and assign a distinct color. 7. Click Save.
    • Adds Line visualization option under Visualization in the Pivot Chart widget, enabling multi-line timeline charts that compare trends across categories or multiple metrics over time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports dimension-based segmentation via Dimension Row — each unique field value (e.g., OS: Type, Status) creates a separate line, up to 20 lines displayed.
    • Supports multi-measure comparison mode: leave Dimension Row empty and use + Add under Metrics to plot multiple fields (e.g., asset counts, vulnerability scores) on the same time axis.
    • Adds Dimension Column configuration to set the x-axis time field, supporting date fields such as Last Seen or Created for latest data, or automatic Data over time for historical snapshots.
    • Adds Aggregate by setting with options Day, Week, Month, Quarter, or Year for time-period grouping; daily aggregation supports click-through to the asset list.

    +4 more show less

    • Adds Y-axis settings under Presentation to set fixed or auto-calculated Min and Max values for the y-axis scale.
    • Adds Metrics configuration supporting Count, Sum, and Average calculation functions, with per-measure color picker in multi-measure mode.
    • Adds Calculation options including Show results from the last X days, Include entities with no value, and Include rows and columns with only zero values.
    • Supports Export to CSV from the chart menu to export timeline chart data.

    9 details in Everything

45. docs update Oct 5, 2026 · issue 095

    Axonius Pivot charts now support two-dimension stacked bar configuration with separate row, column, and metric axes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Visualize OS end-of-life exposure across your asset fleet — each bar is an OS type, stacked by end-of-life status, with bar length showing asset count.
    📍In the Pivot chart editor: set Data to your target asset query, set Dimensions Row to OS type, set Dimensions Column to OS end-of-life, set Metrics to count of assets, then click Save.
    • Adds two-dimension stacked bar support to the Pivot chart, letting practitioners set a Dimensions Row (y-axis), Dimensions Column (stacking), and Metrics (x-axis count) independently for richer vulnerability and asset visualizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

46. docs update Oct 5, 2026 · issue 095

    Axonius adds a Pivot Chart Table visualization with CSV export, click-through asset drawers, unlimited dimensions, and grand total rows/columns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Configure a Pivot Chart Table showing software instances by CVE severity and OS type, with grand totals, to identify vulnerable software distribution across your fleet.
    📍1. On an editable dashboard, click Add Chart. 2. Set Widget to Pivot Chart and Visualization to Table. 3. Under Data, select the Devices module and your target query. 4. Under Dimensions Row, add Vulnerable Software: CVE Severity and Vulnerable Software: Software Name. 5. Under Dimensions Column, add OS: Type. 6. Under Metrics, add Assets with function Count and Preferred OS: Is End of Support with function Count True. 7. Under Presentation, enable Show Grand total for rows and Show Grand total for columns. 8. Click Save.
    • Adds a Pivot Chart Table visualization type selectable under Visualization in the chart wizard, supporting unlimited row and column dimensions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds click-through on table cells to open a drawer listing all assets represented in that cell, with an Asset Page link for further investigation.
    • Adds Show Grand total for rows and Show Grand total for columns presentation options to Pivot Chart Tables.
    • Adds Set threshold colors presentation option to Pivot Chart Tables.
    • Adds expand/collapse for rows with sub-rows, column and row sorting, adjustable column widths, and infinite scroll to Pivot Chart Tables.

    5 details in Everything

47. docs update Oct 5, 2026 · issue 095

    Axonius adds a Map visualization to the Pivot Chart widget, letting practitioners plot Activities module data geographically on editable dashboards.

    • Adds a Map visualization option under the Pivot Chart widget on editable dashboards, displaying Activities module data geographically.
    • Supports configuring Dimensions, Metrics, Calculation (historical data, entities with no value), and Presentation (threshold colors, chart title toggle) for Map charts.
    • Shows a popup with location-specific data when hovering over a map region that contains activity data.

    3 details in Everything

    • Updated integration Map chart location field support for Okta, Microsoft Azure, and Microsoft Active Directory
48. docs update Oct 5, 2026 · issue 095

    Axonius Pivot charts now support a two-dimension Stacked Bar Chart style with configurable y-axis, stacking, and x-axis metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Visualize vulnerability status trends over time by stacking counts by Status across Last Status Update date bars in a Pivot chart.
    📍In the Pivot chart editor: 1. Under Data, select the asset type and query. 2. Under Dimensions Row, select Last Status Update (grouped by month). 3. Under Dimensions Column, select Status. 4. Under Metrics, select the count of vulnerability instances. 5. Click Save.
49. docs update Oct 5, 2026 · issue 095

    Axonius: Supports three line chart modes: single-line (one aggregated trend), multi-line with dimension segmentation (one line per category value such as OS type or asset status), and multi-line with multi-measure comparison (multiple metrics on one timeline).

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Track daily adapter fetch activity over 30 days to spot ingestion failures or gaps in asset coverage.
    📍1. On an editable dashboard, click Add Chart. 2. In Name, enter Total Adapter Fetches - 30 Days. 3. From Widget, select Pivot Chart. 4. Under Visualization, select Line. 5. Under Data, select the Adapter Fetch History module. 6. (Schema is fixed to Latest Data for this module.) 7. Under Dimension Column, select Start Time, then click the edit icon and set aggregation to Day. 8. Leave Dimension Row empty. 9. Under Metrics, select a count field with the Count function. 10. Set Calculation to the last 30 days, then click Save.
    Compare how asset counts change over time by OS type, using historical snapshots to reveal drift in your fleet composition.
    📍1. On an editable dashboard, click Add Chart. 2. From Widget, select Pivot Chart. 3. Under Visualization, select Line. 4. Under Data, select an asset module (e.g. Devices) and a relevant query. 5. Under Schema, select Data over time (snapshots). 6. Under Dimension Column, select Last Seen and set aggregation to Week. 7. Under Dimension Row, select your OS type field to segment lines by OS. 8. Under Metrics, select Count, then click Save.
    • Introduces Schema option in line chart configuration with two modes: Latest Data (aggregates by a selected date field from the current fetch) and Data over time (snapshots) (historical snapshots, available for asset modules only).
    • Adds Dimension Column time-field selector for the x-axis with configurable aggregation granularity: Day, Week, Month, Quarter, or Year.
    • Modules Adapter Fetch History, Activity Logs, Audit, and Security Findings are available for line charts but restricted to Latest Data schema only — historical snapshots are not supported for these modules.

    3 details in Everything

50. docs update Oct 5, 2026 · issue 095

    Axonius adds a Pivot Chart widget with bar, pie, stacked, line, table, and map visualizations for flexible asset-data segmentation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Surface vulnerable-software exposure by CVE severity across all devices — using complex-field segmentation to count CVE IDs per severity level.
    📍In Axonius, create a new dashboard chart and select Widget: Pivot Chart. Under Visualization choose Stacked. Under Data › Module select Devices and leave the query empty. Under Dimensions › Axis pick the vulnerable-software complex field. Under Metrics select CVE ID inside the same complex field, then set Calculation › Function to Count. In Presentation, enable Aggregate remaining segments as Others and set Set maximum segments to display to 20.
    Compare today's device count against a prior baseline date to quantify fleet growth or shrinkage in a single dashboard tile.
    📍Create a Pivot Chart widget. Under Visualization choose Bar. Under Data › Module select Devices; under Schema choose Latest data and toggle on Show results for previous date, then pick the baseline date. Under Metrics select the Asset field with Function: Count. Under Calculation enable Compare results and select the same previous date.
    • Adds a Pivot Chart dashboard widget that segments asset fields across Bar, Pie, Summary, Stacked, Line, Table, and Map visualization types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports Data over time (snapshots) schema mode in the Pivot Chart to query historical asset data alongside Latest data from the most recent fetch.
    • Adds Show results for previous date toggle in Pivot Chart Data settings to pin results to a fixed or relative historical date.
    • Adds Compare results option in Pivot Chart Calculation settings to display a side-by-side comparison of latest vs. a previous date's query results.
    • Supports up to 1 dimension column and 3 dimension rows in the Pivot Chart Dimensions section, with per-axis custom naming and inline filtering.

    +6 more show less

    • Adds Set maximum segments to display option in Pivot Chart Presentation for bar charts (default 10, maximum 20) with an Aggregate remaining segments as 'Others' rollup.
    • Adds Aggregate by time-period selector (Day, Week, Month, Quarter, Year) in Pivot Chart Presentation for the Timeline visualization.
    • Enables complex-field segmentation in the Pivot Chart Metrics section, allowing a field (e.g., CVE severity) within a complex table to segment and count a nested field (e.g., CVE IDs).
    • Distinguishes adapter-connection counts from unique-asset counts in Pivot Chart by choosing the Asset field with the Count function versus a specific asset attribute field.
    • Supports up to 10 simultaneous measurements in the Pivot Chart Matrix visualization.
    • Adds Include entities with no value toggle in Pivot Chart Calculation to assign a custom display name to assets lacking a value for the selected parameters.

    11 details in Everything

51. docs update Oct 5, 2026 · issue 095

    Axonius adds a Dashboard Templates gallery with 40+ pre-built workspaces spanning asset inventory, cloud, identity, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., compliance, and incident response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Spin up a CrowdStrike agent coverage dashboard instantly to see Missing, Headless, and Inactive agents across your fleet — without building charts from scratch.
    📍In the Axonius UI, go to Dashboards › Dashboard Templates gallery, locate CrowdStrike Agent Coverage under Tool Coverage, and click Use Template to create a pre-configured dashboard.
    Accelerate an active incident investigation by launching the Incident Response: Device dashboard and scoping it to a single host using the built-in Set Filter feature.
    📍In the Axonius UI, go to Dashboards › Dashboard Templates gallery, select Incident Response: Device under Users & Identity, click Use Template, then use the Set Filter control on the dashboard to filter to the device under investigation.
    Surface CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. data-quality gaps — devices missing from ServiceNow and install-status discrepancies — using the pre-built reconciliation dashboard.
    📍In the Axonius UI, go to Dashboards › Dashboard Templates gallery, select ServiceNow Reconciliation under Data Quality & CMDB, and click Use Template to create the dashboard.
    • Adds a Dashboard Templates gallery where selecting a template instantly creates a new dashboard pre-populated with charts and queries — no manual chart building required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Executive & Security Posture templates: Executive Report, Security Posture, Environment Hygiene, IT Audit Insights, Exposures Management (requires Risk Score feature), and External Exposures.
    • Adds Inventory by Device Class templates covering Comprehensive Asset Inventory, Device Inventory Management, Windows Workstations, Windows Servers, Linux Devices, Mobile Devices, Network Devices, Printers, Medical Devices (IoMT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure.-OT), and OT Devices.
    • Adds Cloud templates for multi-cloud (Cloud Inventory) and provider-specific views: AWS Inventory, Microsoft Azure Inventory, and Google Cloud Provider Inventory — each requiring the corresponding adapter to be connected.
    • Adds Emerging Threats & Patch templates: CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning. and Windows Patch Tuesday Posture (clients/servers lagging more than 2 cumulative updates).

    +7 more show less

    • Adds a Tool Coverage template for CrowdStrike Agent Coverage, surfacing Missing, Headless, and Inactive agent states.
    • Adds Data Quality & CMDB templates: Data Hygiene (questionable-data sources) and ServiceNow Reconciliation (CMDB discrepancies including missing devices and install-status values).
    • Adds Users & Identity templates: Users Inventory Management, Users Password Insights, Identity Management Overview (MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enrollment, non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.), Incident Response: Device (with Set Filter for single-device drill-down), and Incident Response: User.
    • Adds Software templates: Software Hygiene and Software Management.
    • Adds SaaS templates (requires Axonius SaaS Applications product): SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. Overview, SaaS Applications, Application Settings (SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.), Cost Optimization, SaaS Inventory Discovery, SaaS Posture Management, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Overview, Google Workspace Overview, and Zoom Configurations and Insights.
    • Adds Compliance & Programs templates: Mergers & Acquisitions and NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework.: Identify ID.AM.
    • Template visibility is gated by activated Axonius products, and some templates are available only as part of Axonius Workspaces.

    12 details in Everything

52. docs update Oct 5, 2026 · issue 095

    Axonius adds preconfigured Dashboard Templates with per-template previews, adapter gap detection, and personal preference-based recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Spin up a role-relevant dashboard in minutes by picking a preconfigured template instead of building charts from scratch.
    📍In the Axonius UI, go to Dashboards › Add Dashboard › Dashboard Templates. Browse templates by use-case category in the left pane, hover a tile, click Preview to inspect chart thumbnails and sample data, then click Select to create the dashboard.
    Identify and fill adapter gaps surfaced by a newly created template dashboard so charts populate with real data.
    📍After creating a templated dashboard, locate the adapter gap widget listing missing categories, then click Connect Adapters to open the Adapters page pre-filtered to the relevant category. Click Remind Me Later to resurface the widget, or X to permanently dismiss it.
    • Adds Dashboard Templates: preconfigured dashboards built around common themes (use-case categories), pre-populated with saved queries, accessible from the Add Dashboard list by selecting Dashboard Templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a template preview flow — hover any template tile, click Preview to see chart thumbnails, sample data, and What's this chart? descriptions before committing to a template.
    • Adds an adapter gap widget within templated dashboards that lists missing adapter categories and surfaces a Connect Adapters shortcut filtered to the relevant category.

    3 details in Everything

53. docs update Oct 5, 2026 · issue 095

    Axonius gains Dashboard import/export in JSON format, enabling migration between environments with granular access controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Move a customised Dashboard from a staging Axonius environment to production without rebuilding charts or queries.
    📍In the source environment: open the Dashboard page, click the three-dot menu next to the Dashboard name, and select Export Dashboard. A JSON file is downloaded to your local computer. In the target environment (same major version): open the Dashboard page, click the Add Dashboard dropdown, select Import Dashboard, upload the JSON file, enter a name, choose Who has access, and click Save. Select Overwrite if a dashboard with the same name already exists, or Create a Copy to keep both.
    • Adds Export Dashboard action (via the three-dot menu next to a Dashboard name) to download any non-system Dashboard as a JSON file containing all charts, settings, and queries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Import Dashboard option in the Add Dashboard dropdown, supporting upload of a JSON dashboard file with Overwrite or Create a Copy conflict resolution and per-role access assignment at import time.
    • Requires the Export dashboard permission on an unrestricted role to export, and Import Dashboard, View Dashboards, Add Dashboards, Add charts, Delete charts, View entity, Add saved queries, and Edit saved queries permissions to import.
    • Dashboard import is scoped to the same major version (first two version numbers) — a dashboard exported from 6.0.x cannot be imported into 6.1.x.

    4 details in Everything

54. docs update Oct 5, 2026 · issue 095

    Axonius adds dashboard access permission controls with cascading query permission updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Change a dashboard from Private to Public so all users can view it and its underlying chart queries — navigate to the dashboard, open its menu, and update access.
    📍1. Go to the Dashboards page. 2. In the folders pane, find the dashboard and click the 3-dot menu next to its name. 3. Select Edit to open the Edit Dashboard dialog. 4. In Who has access, select Public (or Shared). 5. Click Save, review the listed affected charts and underlying queries, then click Change Permissions to Shared/Public to confirm.
    • Adds the ability to change access permissions (Private, Shared, Public) for dashboards via the 3-dot menu > Edit > Who has access on the Dashboards page, automatically moving the dashboard to the appropriate folder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Cascades permission changes to underlying chart queries: when a dashboard is promoted (e.g., Private to Public), queries with lower permissions are automatically updated to match, and Axonius verifies the user has the required permissions before applying changes.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !A dashboard with Shared or Public access cannot be changed back to Private access.
    • !Moving a dashboard to Shared access requires the user to be in the Global data scope.
55. docs update Oct 5, 2026 · issue 095
    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Aggressively reclaim stale device records during healthy fetch windows, while retaining a safety-net threshold for failing connections — so inventory stays tight without risking mass deletion during an outage.
    📍In the adapter's Advanced Settings, set 'Delete devices and other assets that have not been returned from the source in the last X hours' (fast cutoff) to 12, and keep 'Delete devices that have not been returned from the source in the last X hours' (standard cutoff) at 48. While the connection fetches successfully, any device absent for 12+ hours is removed immediately; if fetching stops, the 48-hour rule takes over.
    Ensure user records are pruned quickly during successful syncs (e.g. after offboarding) without risking premature deletion when a directory connection is temporarily down.
    📍In the adapter's Advanced Settings, set 'Delete users that have not been returned from the source in the last X hours' (fast cutoff) to 6, and set 'Delete users that have not been returned from the source in the last X hours' (standard cutoff) to 24. Active connections purge unseen users after 6 hours; failing connections fall back to the 24-hour window.
56. docs update Oct 5, 2026 · issue 095

    Axonius adds faster asset/user deletion settings for adapters with active successful fetches⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Aggressively prune stale device records during healthy fetch cycles while keeping a longer safety net if the connection fails.
    📍In the adapter's Advanced Settings, set 'Delete devices and other assets sooner when the connection is fetching successfully' to 12 (hours), while keeping 'Delete devices that have not been returned from the source in the last X hours' at 48. Apply per-connection if different adapters need different windows.
    Prune stale user records quickly during active fetches while retaining a longer fallback window if the connection stops succeeding.
    📍In the adapter's Advanced Settings, set 'Delete users sooner when the connection is fetching successfully' to 6 (hours), while keeping 'Delete users that have not been returned from the source in the last X hours' at 24. Set per-connection overrides where individual connections have different discovery cadences.
    • Adds a new adapter setting to delete devices and other assets sooner when a connection is fetching successfully, as a faster cutoff than the existing 'Delete devices that have not been returned from the source in the last X hours' setting — configurable per adapter or per individual connection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a new adapter setting to delete users sooner when a connection is fetching successfully, as a faster cutoff than the existing 'Delete users that have not been returned from the source in the last X hours' setting — configurable per adapter or per individual connection.

    2 details in Everything

57. docs update Oct 4, 2026 · issue 094

    Axonius lets users duplicate read-only workspace Home page dashboards into editable Shared dashboard copies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Duplicate a read-only workspace Home page dashboard so you can customize its charts and assign it as a workspace Home page.
    📍1. Go to Dashboards › Managed by Axonius › Homepages and open the target dashboard. 2. Click the three-dot menu at the top right of the dashboard. 3. Select Duplicate. 4. The new dashboard opens automatically as a Shared dashboard named COPY - <original dashboard name>, ready to edit.
    Enable dashboard sharing so the Duplicate option becomes available to users with Shared folder permissions.
    📍1. Click the Settings icon in the top right corner of any page. 2. In the Categories/Subcategories pane, expand User and Role Management and select Special Permissions. 3. Under Object Sharing Settings, enable Allow sharing dashboards and queries to all Data Scopes.
    • Adds a Duplicate action on Axonius-managed workspace Home page dashboards (via the three-dot menu inside the dashboard or from the left pane) to create an editable copy in the Shared folder, prefixed with COPY -.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables the Allow sharing dashboards and queries to all Data Scopes setting under Settings > User and Role Management > Special Permissions > Object Sharing Settings to unlock the Duplicate option for workspace Home page dashboards.
    • Adds a Duplicate action on Axonius-managed workspace Home page dashboards (via the three-dot menu inside the dashboard or from the left pane) to create an editable copy in the Shared folder, prefixed with COPY -.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

58. docs update Oct 4, 2026 · issue 094

    Axonius adds node-by-node workflow testing with a safe single-asset sandbox, live dynamic value resolution, and per-node Test Panel UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Test a single If/Else condition node against a different asset to verify the alternate branch fires correctly — without touching production data.
    📍In the workflow canvas, select the Condition node › click View Test Panel › click Change Asset › choose an asset that meets the opposite criteria › click Run Test. The canvas highlights the alternate branch path in green.
    Validate an Event Trigger using data from a previously captured event before wiring up downstream nodes.
    📍In the workflow canvas, select the Event Trigger node › click View Test Panel › under Event Input Fields, select a prior event from the event list (or use the JSON tab to paste event data) › click Run Test. Confirm the resolved asset appears in the Tested on field.
    After completing the full workflow, filter Run History to only test runs to confirm no node produced a production side-effect.
    📍Navigate to Workflows Run History › in the Run Type filter, select Test Run to list only test executions and verify all nodes show a green status indicator.
    • Adds a View Test Panel button on every testable workflow node, letting practitioners open, inspect, and run isolated tests on individual nodes as they build a workflow — without affecting production assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Basic Inputs and JSON input modes in the Test Panel for nodes that require manual data entry during testing.
    • Adds a Run Test button in the Test Panel to execute a test on a single selected node, distinct from the header-level Test Run button that runs the entire workflow.
    • Adds (Switch Asset) / Change Asset controls in the Test Panel to re-run a node test against a different randomized asset, enabling validation of alternate condition branches.
    • Introduces node-by-node incremental workflow testing that runs against a single randomly selected asset, eliminating the risk of mass-actions such as bulk ticket or email creation during validation.

    +7 more show less

    • Adds test status indicators (colorless, green, red circle icons) on each workflow node canvas to reflect the most recent per-node test outcome at a glance.
    • Adds a Tested on field in the Test Panel identifying which asset was used for the current test run.
    • Adds Select Test Run in the Run Type filter on the Workflows Run History page to isolate test runs from production runs.
    • Automatically mocks Delay nodes during testing — acknowledging the logic but skipping wait time — so end-to-end flow can be validated without waiting for full delay durations.
    • Exposes live resolution of Dynamic Value statements in the Test Panel, showing the actual computed value of each expression against the test asset.
    • Supports Event Trigger testing via the Test Panel, with an event list for re-using a previously run event or manual entry via Basic Inputs / JSON tabs; Scheduled and Manual triggers are skipped as they have nothing to test.
    • Highlights the path taken by the test asset through Condition nodes (If/Else, Basic Filter) in green on the workflow canvas.

    12 details in Everything

59. docs update Oct 4, 2026 · issue 094

    Axonius Workflows gain Dynamic Value Statements with a built-in Simulator for testing field interpolation before running actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Debug a Workflow action that tags assets based on event user fields — use the Simulator to validate the concatenation statement before the Workflow ever runs live.
    📍In the Workflow Action node: 1. Enable Configure Dynamic Values. 2. Expand the Workflow Data repository (click '+' in the header) and copy event_first_name and event_last_name into your statement. 3. In Syntax mode, click Simulate above the statement. 4. In the Simulator - Add Missing Data dialog, click View Statement, assign real values to event_first_name and event_last_name, define a Users query under Run On, then click Apply. 5. Hover over components in the statement to inspect Field type, Value type, and Value. 6. Click Exit Simulator Mode when done.
    • Adds Configure Dynamic Values toggle in Workflow Action nodes to dynamically populate action fields using the Dynamic Value Statement Wizard, Syntax Helper, and Autocomplete.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the Workflow Data repository — accessible via the + icon in the header when Configure Dynamic Values is enabled — to copy field values from prior Workflow nodes directly into a Dynamic Value Statement.
    • Adds a Simulate button above Dynamic Value Statements (in Syntax mode) to test statements against a randomly selected asset without running the full Workflow.
    • Adds a Simulator - Add Missing Data dialog that prompts for a query or concrete values when the action runs on non-static fields or assets sourced from the Workflow Data repository.
    • Adds a Replace button in Simulator Mode with Replace Asset (re-run on a new random asset with same data) and Replace Data (re-open the missing-data dialog to change values and asset) options.

    +2 more show less

    • Enables Fail the action if dynamic values fail in Workflow Actions — unlike the Enforcement Action equivalent, this stops only the current action while allowing subsequent Workflow nodes to continue.
    • Supports selecting asset modules other than the default asset type via Asset Fields in the Syntax Helper within Workflow Actions.
    • Adds Configure Dynamic Values toggle in Workflow Action nodes to dynamically populate action fields using the Dynamic Value Statement Wizard, Syntax Helper, and Autocomplete.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the Workflow Data repository — accessible via the + icon in the header when Configure Dynamic Values is enabled — to copy field values from prior Workflow nodes directly into a Dynamic Value Statement.
    • Adds a Simulate button above Dynamic Value Statements (in Syntax mode) to test statements against a randomly selected asset without running the full Workflow.
    • Adds a Simulator - Add Missing Data dialog that prompts for a query or concrete values when the action runs on non-static fields or assets sourced from the Workflow Data repository.
    • Adds a Replace button in Simulator Mode with Replace Asset (re-run on a new random asset with same data) and Replace Data (re-open the missing-data dialog to change values and asset) options.

    2 more in Everything

60. docs update Oct 4, 2026 · issue 094

    Axonius Workflows gain a centralized data repository letting nodes dynamically consume assets, fields, variables, and artifacts from earlier steps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Override a downstream Action node's target asset to run on a Vulnerability resolved by an earlier node rather than the default preceding-node asset.
    📍In the Action node configuration, open the Workflow Data dialog (+/- icon in the header), go to the Actions Data tab, locate the earlier node by its UUID and Action name, copy the resolved Vulnerability asset reference, then paste it into the Query Wizard asset selector for the current Action node.
    Inject a field value from a prior Action into a Dynamic Value statement — for example, pulling the BambooHR subdomain captured by an earlier action into a ServiceNow incident creation step.
    📍In the Dynamic Value Wizard, open the Workflow Data dialog, select the Actions Data tab, find the BambooHR - Suspend Employee node entry, and insert the reference Action[06E0].form.subdomain into the Dynamic Value statement field.
    Use a field from an earlier Slack Message event to set an Event condition that filters on the manager who triggered the event.
    📍In the Event node's condition builder, open the Workflow Data dialog, select the Events Data tab, locate the Slack Message event entry by UUID, and copy the Manager Name adapter field reference into the Event condition value field.
    • Adds a Workflow Data repository that stores assets, Dynamic Value results, variables, and artifacts from preceding nodes so later nodes can reference them without manual handoff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Events Data tab in the Workflow Data dialog to expose parsed fields and asset-field queries from each Event node that triggered the workflow.
    • Adds an Actions Data tab in the Workflow Data dialog to expose resolved assets, Dynamic Value statement results, and adapter fields from each completed Action node.
    • Adds a Variables tab in the Workflow Data dialog listing all explicitly written variables, which persist across runs within the same workflow.
    • Adds an Artifacts data tab in the Workflow Data dialog providing artifact information generated by previous actions.

    +4 more show less

    • Enables overriding an Action node's default asset (the asset passed from the immediately preceding node) with a resolved asset from any earlier Event or Action node via the Query Wizard inside the Action node's configuration.
    • Adds data-type icons — covering String, Numeric, Float, Date, Boolean, Complex, IP, List, and Unknown — displayed next to field names across the Data Bank, Dynamic Value Wizard, autocomplete, and debugging node inspector wherever workflow data fields are selected or inspected.
    • Allows copying stored node data (identified by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. plus Action/Event name) directly into the configuration of the current node being edited.
    • Supports referencing previous Action node configuration fields using a path syntax such as Action[<UUID>].form.<field> (for example, Action[06E0].form.subdomain) inside Dynamic Value statements and Event conditions.

    9 details in Everything

61. docs update Oct 4, 2026 · issue 094

    Axonius Workflows gain node-by-node action testing, bulk-asset runs, and conditional asset filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Validate an action node's field configuration before deploying — catches credential issues and dynamic-value resolution failures without affecting production assets.
    📍In the Workflow canvas, select the Action node, then click View Test Panel. Click Run Test and review the results: Success/Failure Status, Node Output, Assets Affected, Artifact Data, and Errors.
    Run a disable action across all service accounts returned by a query during an offboarding workflow, rather than one at a time.
    📍In the Action Setup drawer, click Select Asset Using the Query Wizard. Under 'Run action on assets that match the query', choose the relevant Module, configure your query, then in Additional Settings set Number of Assets to All Assets.
    Stop a multi-step remediation workflow immediately if a critical action (e.g. account disable) fails, preventing subsequent actions from running on a bad state.
    📍In the Action node's settings pane, enable 'Stop the workflow when this action fails'.
    • Adds Stop the workflow when this action fails setting on Action nodes to halt workflow execution immediately on action failure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Only assets that match the latest condition option on Action nodes following a Condition node, enabling conditional asset filtering with per-path propagation rules.
    • Adds Run action on resolved assets from previous nodes dropdown in the Action Setup drawer, letting actions target assets from any upstream Event or Action node (identified as Action[node UUID]. or Event[node UUID].).
    • Adds Query Wizard integration in the Action Setup drawer, allowing an action to run on assets from a new or existing query via Select Asset Using the Query Wizard.
    • Adds First Asset / All Assets selection under Number of Assets in the Action Setup Additional Settings section, enabling bulk runs across all query results.

    +5 more show less

    • Adds Edit Asset pencil icon next to the Runs on field on Action nodes, allowing the action's target asset to be changed with a Change Asset confirmation step.
    • Adds Reset to default control on Action nodes to revert asset selection to the previous node's resolved asset.
    • Adds node-by-node Action testing via a View Test Panel / Run Test flow, surfacing Success/Failure Status, Node Output, Assets Affected, Artifact Data, and Errors.
    • Adds Link with a Case button on Create Issue/Incident/Ticket category actions and a Link with a Ticket button on Create new case actions, opening the Create A Case Set wizard.
    • Supports bulk-run use cases including IDM joiner/mover/leaver offboarding, sending a single user or Slack channel a list of assets, case management unification, and running multiple Enforcement Actions on different queries in a single Workflow.

    10 details in Everything

62. docs update Oct 4, 2026 · issue 094

    Axonius Workflows gain configurable Events with webhook integration, field parsing via AXONIUSPARSER, and per-node timeout settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Parse structured metadata embedded in a Slack message field into key-value pairs so downstream Action nodes can reference individual values via Dynamic Value Statements.
    📍In the Workflow canvas, click the Slack Message Event node › in the Event pane, toggle on Parse additional fields › from the 'Select event field to parse JSON from' dropdown, select the string field containing: AXONIUSPARSER {"ticket_id": INC-42, severity: high}
    Prevent a non-triggering Event from hanging indefinitely by setting a 90-day timeout that branches the Workflow when the event does not complete in time.
    📍In the Workflow canvas, click the Event node › in the Event pane, toggle on Add Timeout › set After to 90 Days › add an Event Conditions node below with a True branch (timeout reached) and a False branch (event completed successfully).
    Wire up a third-party webhook so Axonius can receive events from an external system for the first time, including supplying the signing secret for trust verification.
    📍Navigate to System Settings › External Integrations › Workflows › click View configuration for the target product › copy the Webhook URL and signing secret from the Webhook Configuration Details dialog into the vendor's webhook settings › click Enable Webhook.
    • Adds Parse additional fields toggle and Select event field to parse JSON from dropdown on any Workflow Event node, enabling automatic parsing of string fields containing AXONIUSPARSER {"key1": "value1"} into key-value pairs for use in Dynamic Value Statements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Add Timeout toggle on non-triggering Event nodes, configurable in Days, Weeks, or Months (default 90 days), with a choice to define a Timeout condition branch or terminate the Workflow run on timeout.
    • Adds webhook configuration for third-party Workflow Events, accessible from System Settings > External Integrations > Workflows or directly from the Event pane, supporting a dedicated Webhook URL and signing secret exchange with the vendor.
    • Introduces the Event Fields button on Workflow Event node configuration panes, showing a table of Field Name and Field Type for every field in the event — useful for building Event Condition filters and trigger conditions.
    • Supports selecting and configuring non-triggering Workflow Events from the Event pane and triggering Events from the Trigger Type pane, with Cards and List view toggles, Search Event box, and Category dropdown filtering by categories including Generic Webhook Events, Axonius Utilities, Message Received, Message Responses, User Onboarded or Offboarded, Incident Created or Updated, and Group Created or Updated.

    +1 more show less

    • Enables event collection in a product adapter for third-party events by navigating to the Adapter Events Configuration dialog and selecting Enable events in adapter.

    6 details in Everything

63. docs update Oct 4, 2026 · issue 094

    Axonius adds flexible workflow scheduling with seven schedule plans, cycle-aware delay, and configurable end conditions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Trigger a remediation workflow immediately after a specific adapter finishes fetching, so downstream actions always act on the freshest data from that source.
    📍In the Trigger Type pane, select Scheduled. Under Select a Schedule Plan, choose Every Successful Adapter Fetch. From the Select Connection dropdown, pick the target adapter connection, then click Save and Run.
    Run a workflow on a precise recurring cadence — every Monday and Wednesday between 08:00 and 14:00, every 2 hours — while avoiding stale data during an active Discovery Cycle.
    📍In the Trigger Type pane, select Scheduled. Under Select a Schedule Plan, choose Custom. Set Repeat every 2 hours, enable Run the Workflow on specific days and select Monday and Wednesday, set the hour range to 08:00-14:00, then enable Wait until cycle ends and click Save and Run.
    Limit a weekly workflow to a fixed three-month window, with a visible countdown and the ability to reset the clock if the project is extended.
    📍In the Trigger Type pane, select Scheduled. Choose Weekly on [Current Day], set Run time to the desired hour. Under the schedule-end options, select After and enter 3 months, then click Save and Run. The system displays Remaining: 3 Months; click Reset Count at any time to restart the countdown.
    • Adds Every Successful Adapter Fetch schedule plan, which triggers a workflow after each successful fetch of a single adapter connection selected from the Select Connection dropdown — covering fetches inside or outside the Discovery Cycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Custom schedule plan for workflows, supporting repeat intervals in hours, days, weeks, or months (X > 0, max 24, fractions allowed), specific weekday selection, and hour-range constraints.
    • Adds Wait until cycle ends option for scheduled workflows that overlap a Discovery Cycle, postponing execution until the cycle completes (available for all plans except Every Global Discovery Cycle and Every Successful Adapter Fetch).
    • Adds schedule-end configuration for workflow schedule plans: choose Never (default), On (specific end date), or After (X months, days, weeks, or occurrences), with a live Remaining: countdown and a Reset Count action.
    • Adds Schedule Once plan to run a workflow exactly once at a chosen date and time.

    +4 more show less

    • Adds Weekly on [Current Day] plan to run a workflow once a week on the day it was configured, with selectable run hour (default 13:00) or immediate execution via Now.
    • Adds Daily schedule plan with a configurable run hour (default 13:00).
    • Adds Every 12 Hours schedule plan, firing at 00:00 and 12:00.
    • Adds Every Global Discovery Cycle as the default schedule plan, running a workflow at the end of each Global Discovery Cycle.

    9 details in Everything

64. docs update Oct 4, 2026 · issue 094

    Axonius Workflows gain three trigger types — Event, Scheduled, and Manual — with per-trigger asset and event filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Run a Workflow only on newly discovered devices with AD admin permissions since the last Discovery Cycle, to avoid re-processing already-tagged assets.
    📍In the Trigger Type pane of a Scheduled workflow: 1. Go to Select a Schedule Plan and configure your schedule (e.g. every Discovery Cycle). 2. Select the Run on added entities only checkbox. 3. Under the Trigger By - Scheduled node, click + › Add Action and select your Enforcement Action. 4. Under 'Run workflow on assets matching the following query', select Module = Devices and choose (or create) the query 'devices with AD admin permissions'.
    Trigger a Workflow from incoming Slack messages even if no correlated asset is found yet — useful for new-employee onboarding before devices appear in discovery.
    📍In the Trigger Type pane of an Event workflow: 1. Select the Slack Message Event from the Events Library. 2. Expand the Filter section and select Filter based on event criteria. 3. Set Select Field = channel, Func = Equals, Comparison Value = #it-onboarding. 4. Enable 'Trigger workflow even if no assets are found'. 5. Save the Workflow.
    • Adds three Workflow trigger types: Event (default, fires on internal Axonius or third-party events), Scheduled (runs on a defined schedule), and Manual (on-demand via Save and Run).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Trigger workflow even if no assets are found option on Event triggers, letting third-party-triggered Workflows (e.g. new-employee onboarding, policy-violation alerts) proceed even when no assets are resolved.
    • Adds Run on added entities only checkbox for Scheduled triggers, so the Workflow runs only against assets that are new since the previous run — useful for tagging new devices or alerting on new vulnerabilities.
    • Adds event-based filtering on Event triggers (Filter based on event criteria) with field, function (Equals, >, <), and comparison-value controls, so only events matching specific criteria (e.g. Slack messages from IT admins) start the Workflow.
    • Adds asset-based filtering on Event triggers (Filter based on asset criteria) via the Query Wizard, so only events related to assets matching a saved query start the Workflow.

    +3 more show less

    • Adds an Events Library reference and Enforcement Actions Library reference as navigable resources for configuring supported events and triggering actions.
    • Supports parsing Event fields into additional fields via an Enable parsing an Event field into additional fields option on Event triggers.
    • Transmits ID and Refine Data filters from the triggering Action to all downstream Workflow nodes, so successive actions run only on asset entities not filtered out by the saved query.

    8 details in Everything

65. docs update Oct 4, 2026 · issue 094

    Axonius introduces a visual Workflows builder with trigger types, conditional branching, delay nodes, and an AI-powered node recommendation engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Build a scheduled workflow that sends an interactive Slack message to affected assets and branches on the user's response — useful for automated, human-in-the-loophuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. remediation.
    📍1. In the left navigation panel, click the Action Center icon, then click the Workflows tab. 2. Click Create Workflow. 3. In the Trigger Type pane, select Scheduled and configure your schedule. 4. Hover over the Trigger By node, click '+', and click Add Action. Select Slack - Send Direct Message to Assets, configure the Module, Query Name, and predefined response buttons. 5. Hover over the Action node, click '+', and click Add Event. Select Slack Message Response. 6. Hover over the Event node, click '+', and click Add Condition. Set condition: Response Equals Yes. 7. On the True branch, click '+' and click Add Delay. Set delay to 5 hours. 8. On the Delay node, click '+' and click Add Action. Select Axonius - Add Tag to Assets and configure it. 9. Click Save and Run.
    Use the Recommendation engine to quickly chain a Teams message action with its response event — ideal when building interactive approval workflows.
    📍1. In an existing workflow, add a Microsoft Teams - Send Message Action node and configure it. 2. Hover over the '+' icon below that node. 3. In the Suggested section, click Add Teams Message Response to insert the pre-recommended Event node. 4. Continue adding Add Condition, Add Action, or other nodes below the Event node as needed. 5. Click Save and Activate.
    • Adds a visual workflow canvas with a two-pane interface: a left Workflow canvas and a right Configuration pane for the selected node.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports three trigger types — Event (webhook/external), Scheduled, and Manual — selectable when creating a workflow in Action Center > Workflows.
    • Adds Add Condition node type, which creates Event Conditions or Action Conditions branches with After and True paths for conditional workflow logic.
    • Adds Add Delay node type to pause workflow execution for a configurable duration between steps.
    • Adds Repeat for Each node type that creates a nested loop beginning with an Action for iterating over asset sets.

    +6 more show less

    • Adds Add Variables node type backed by a Write to data repository node for storing and reusing data across workflow steps.
    • Adds Add Query node type for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. asset queries directly as workflow nodes.
    • Adds a Workflow Node Recommendation engine that suggests up to three contextually relevant next nodes based on the previous node in the workflow.
    • Supports suggested response events for Slack - Send Direct Message to a User, Slack - Send Message via Webhook, Microsoft Teams - Send Direct Message to a User, Microsoft Teams - Send Message, Microsoft Teams - Send Direct Message to Assets, and Microsoft Teams - Send Direct Message to a Channel interactive actions.
    • Workflow Save and Activate is available for Event-triggered workflows; Save and Run is available for Scheduled and Manual workflows.
    • Supports importing and exporting workflows as an alternative to manual creation.

    11 details in Everything

66. docs update Oct 4, 2026 · issue 094

    Axonius Workflows gains a folder pane for organizing workflows into up to five levels of nested subfolders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds a Folders pane on the Workflows page with three system folders — All Workflows, Shared Workflows, and Drafts — to organize and locate workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Search Folders box in the Folders pane to find specific folders quickly.
    • Enables creating, renaming, moving, and deleting custom subfolders (up to five levels deep) under the Shared Workflows folder.
    • Adds a Drafts system folder that automatically stores incompletely configured workflows, such as those missing a trigger event, ending on a Condition node, or having incomplete field values.

    4 details in Everything

67. docs update Oct 4, 2026 · issue 094

    Axonius Workflows adds a no-code automation engine for chaining events, conditions, actions, and delays across third-party systems.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Respond to a Rapid7 alert by automatically opening a Jira ticket and notifying the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. manager — without writing any code.
    📍In the Axonius console, go to Workflows › (new Workflow) › add an Event trigger for the incoming Rapid7 alert › add an Action to create a Jira ticket with alert details › add a second Action to send an email to the SOC manager › Save and Enable.
    Iterate a compliance remediation action over each non-compliant asset individually, rather than processing them as a bulk group.
    📍In the Axonius Workflows canvas, after your query-based Event trigger, add a Repeat For Each loop node, then place your remediation Action (e.g., open a Jira ticket) inside the loop so it executes once per asset.
    Automate employee offboarding when BambooHR reports a termination: suspend accounts across SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tools in one Workflow.
    📍In the Axonius console, go to Workflows › (new Workflow) › add an Event trigger for BambooHR employee status changed › add a Condition node checking if status equals terminated › on the true branch, add Actions to suspend the user in Google Workspace, Slack, and Salesforce › on the false branch, add an Action to apply a tag › Save and Enable.
    • Adds Repeat For Each loop node in the Workflow canvas to iterate a Workflow over individual assets when a query returns multiple results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the Workflows engine: define chains of Events, Conditions, Actions, and Delays triggered by internal Axonius events (asset added/removed across Discovery Cycles), scheduled runs, manual execution, or incoming external events from integrations such as Slack, BambooHR, Okta, Workday, Zendesk, and Rapid7.
    • Adds a Workflows canvas for visually building sequential and conditional automations, with support for bulk runs (all assets available in a single Workflow context) or per-asset iteration via loop nodes.
    • Adds a Run History page showing execution records for all Workflows or a specific Workflow.

    4 details in Everything

68. docs update Oct 4, 2026 · issue 094

    Axonius adds Import/Export Enforcement Sets to share and migrate enforcement workflows across environments and data scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Migrate enforcement sets from one Axonius environment to another — export from source, then import into target with conflict resolution.
    📍1. In the source environment, go to Action Center › Enforcement Sets. 2. Select the checkboxes for all enforcement sets to migrate, click the 3-dot menu above the table, and select Export. Confirm the credentials-exclusion warning and click Export — a ZIP file is downloaded. 3. In the target environment, go to Action Center › Enforcement Sets, open the Create Enforcement Set dropdown, and click Import Enforcement Set. Upload the ZIP file. 4. For each conflict detected, choose Save as copy (to keep both) or Overwrite (to replace the existing item), then click Import. 5. Refresh the page to confirm the imported enforcement sets appear in the table.
    • Adds Import Enforcement Set capability from the Create Enforcement Set dropdown in the Action Center, allowing one or more enforcement sets to be imported from a ZIP file with conflict resolution options (Save as copy or Overwrite).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Export option via the 3-dot menu on individual enforcement sets or in bulk (via checkbox selection), packaging selected enforcement sets into a ZIP file for transfer across Axonius environments or data scopes.
    • Introduces Add/Import Enforcement and Export Enforcement permission controls governing who can import or export enforcement sets.

    3 details in Everything

69. docs update Oct 4, 2026 · issue 094

    Axonius adds manual termination of In Progress and Pending Enforcement Set runs from the Run History page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Stop a runaway Enforcement Set mid-execution before it applies unwanted changes to additional assets.
    📍In Axonius, go to Enforcements › Run History. Hover over the row of the In Progress Enforcement Set run, then click the Terminate icon at the end of the row. Confirm termination in the dialog.
    Bulk-cancel multiple queued or running Enforcement Sets — for example, after a misconfigured policy is triggered at scale.
    📍In Axonius, go to Enforcements › Run History. Select the checkboxes for the target runs (or use Select All), then click the Terminate Task action in the top right. Confirm to permanently terminate all selected runs.
    • Adds a Terminate icon on individual Enforcement Set run rows in the Run History table to stop a single In Progress or Pending run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Terminate Task bulk action in Run History to terminate multiple selected Enforcement Set runs at once, available when at least one selected run has a Result of In Progress or Pending.

    2 details in Everything

70. docs update Oct 4, 2026 · issue 094

    Axonius adds Enforcement Set duplication, with optional cloning of automation/scheduling settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    When you need a new Enforcement Set that shares most actions with an existing one but should run on a different schedule, duplicate the original and strip its automation settings.
    📍1. Go to the Enforcements page. 2. Hover over the row of the Enforcement Set you want to copy and click the Duplicate icon (or select its checkbox and click the Duplicate action in the top-right). 3. In the Make a copy of dialog, enter a new name in Enforcement set name. 4. Clear the Clone automation settings checkbox to remove the original schedule. 5. Click Create a Copy, then configure a new schedule in the Scheduling type section and click Save.
    • Adds the ability to duplicate an Enforcement Set via the Duplicate icon or Duplicate action on the Enforcements page, with a Clone automation settings checkbox to carry over or strip the run schedule from the copy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

71. docs update Oct 4, 2026 · issue 094

    Axonius: Adds Run on top N results only and Run on added entities only result-limiting options under the Additional Conditions section so Enforcement Sets operate on a bounded or delta asset set.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Ensure a CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context.-population Enforcement Set always runs on fully updated asset data after a Discovery Cycle completes.
    📍In the Create Enforcement Set drawer, select the Select Schedule tab › set the schedule plan to Daily › enable Wait until cycle ends › under Adapter Fetches, enable 'Only if the following adapter connections successfully completed' and select the relevant adapter connections › click Save and Run.
    Trigger an Enforcement Set only for newly discovered devices with AD admin permissions, avoiding reprocessing of already-actioned assets.
    📍In the Create Enforcement Set drawer, select the Select Schedule tab › select schedule plan Every Global Discovery Cycle › expand Additional Conditions › under Limit Results, enable Run on added entities only › click Save and Run.
    Run a compliance Enforcement Set immediately after a specific adapter finishes fetching, rather than waiting for the full Discovery Cycle.
    📍In the Create Enforcement Set drawer, select the Select Schedule tab › select schedule plan Every Successful Adapter Fetch › from the Select Connection dropdown, choose the target adapter connection › click Save and Run.
    • Adds If number of assets is above N and If number of assets is below N triggering conditions so an Enforcement Set fires only when the query result count meets a numeric threshold.
    • Adds If assets have been added since the last execution and If assets have been removed since the last execution last-run-comparison triggers so Enforcement Sets react to asset-count changes.
    • Adds an Only if the following adapter connections successfully completed condition that gates Enforcement Set runs on successful fetches from selected adapter connections.
    • Enables run-priority ordering for multiple Enforcement Sets scheduled to run at the same time every Global Discovery Cycle, configurable directly from the Enforcements page.

    4 details in Everything

72. docs update Oct 4, 2026 · issue 094

    Axonius adds a dedicated Enforcement Set Run History page with filtering, drill-down, and CSV export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Identify all Enforcement Set runs that took longer than expected to spot potential performance problems.
    📍In the Axonius UI, go to Enforcements › Run History. In the filter bar, select Duration, choose Greater than, and enter the threshold in HH:MM:SS.ss format (e.g., 00:30:00.00). Review the returned runs for anomalies.
    Review the full enforcement run history for a specific asset after a failed action to trace the error.
    📍In the Run History table, click a Failed run row to open the Run drawer › click the Failed count link to open the Assets page › click an asset › open the Enforcement Runs tab › inspect the Additional Info column for the error detail.
    Narrow Run History to a single Enforcement Set and export results for reporting.
    📍In the Axonius UI, go to Enforcements › Run History. In the Enforcement Name filter, type the set name and select it. Then click Export CSV to download the filtered run results.
    • Adds a Run History page accessible from the Enforcements page (via the upper-right Run History button) to view all Enforcement Set runs or a single set's runs in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Enforcement Run History entry under Action Center > Action Center Tools in the new navigation experience.
    • Adds an Export CSV button on the Run History page to export run results.
    • Adds Duration filter on the Run History table (with Equal to, Greater than, or Less than operators and HH:MM:SS.ss format) to isolate unexpectedly long runs.
    • Adds Discovery Cycle filter on the Run History table to show only runs from a specific discovery cycle.

    +6 more show less

    • Adds Action Name filter to find all Enforcement Sets containing a given Enforcement Action.
    • Adds Result filter with states: Completed, Failed, In Progress, Delayed, Partially, Pending, and Terminated.
    • Adds per-run drawer showing per-action detail tabs — including Started/Ended, Type (Main/Success/Failure/Post), Result, and Affected Assets breakdown (Successful, Failed, Additional).
    • Adds Trigger Type column to the Run History table distinguishing Scheduled, Manual Run, Manual Test Run, and Findings Rule triggers.
    • Adds Enforcement Runs tab on the Asset Profile page to view the full enforcement run history for an individual asset.
    • Supports pivoting from Successful, Failed, or Additional asset counts in the Run drawer directly to the Assets page, filtered to those assets.

    11 details in Everything

73. docs update Oct 4, 2026 · issue 094

    Axonius adds Test Run for Enforcement Sets, letting you validate actions on a single random asset before a full run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Validate that an Enforcement Set produces the expected results on a single asset before a potentially wide-impact full run.
    📍1. Configure the Enforcement Set in the Create Enforcement Set drawer. 2. At the bottom of the drawer, click Test Run. 3. In the Test Run dialog, review the randomly selected asset; optionally click Asset Info to inspect it in a new tab. 4. Click Test Run to execute. 5. When complete, review each Enforcement Action result via the links displayed. 6. Click Close to return to the drawer and adjust if needed.
    • Adds Test Run button in the Create Enforcement Set drawer to execute an Enforcement Set against one randomly selected asset before applying it to all matching assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

74. docs update Oct 4, 2026 · issue 094

    Axonius adds a Predefined Enforcement Sets library so practitioners can copy and customize enforcement workflows without starting from scratch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Quickly spin up a new Enforcement Set for a common workflow by copying a predefined template rather than building from scratch.
    📍1. In the Enforcements page, open the Predefined Enforcements sets folder. 2. Select the predefined Enforcement Set closest to your intended workflow. 3. In the Edit Enforcement Set drawer, update the Module, Query, and any required fields. 4. Click Save and Run — the new set is saved under Shared Enforcements and executes immediately.
    • Adds a Predefined Enforcements sets folder on the Enforcements page containing read-only, copyable Enforcement Set templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Copying a predefined Enforcement Set auto-saves to Shared Enforcements when the Module, Query, and required fields are filled in, or to Drafts otherwise.
    • Incomplete copies saved to Drafts remain editable and can be promoted to Shared Enforcements once all required fields are completed.

    3 details in Everything

75. docs update Oct 4, 2026 · issue 094

    Axonius adds folder-based organization for Enforcement Sets, with up to five levels of subfolders under Shared Enforcements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Organize related Enforcement Sets by creating a subfolder under Shared Enforcements — useful when grouping sets by team or asset type.
    📍1. On the Enforcements page, open the Folders pane. 2. Hover over the Shared Enforcements folder and click the Folders menu. 3. Select New Folder — an untitled folder is created. 4. Click the Folders menu again and select Rename to give it a meaningful name (e.g., Endpoint Hygiene).
    Bulk-move Enforcement Sets from the default Shared Enforcements root into a newly created subfolder to reduce clutter.
    📍1. On the Enforcement Sets page, select the checkboxes of the Enforcement Sets you want to move. 2. From the 3-dot More Actions menu at the top right of the table, click the Move action. 3. In the Folder List dropdown, type part of the destination folder name in Search Folders. 4. Click the destination folder and then click Move.
    • Adds a Folders pane on the Enforcements page to organize Enforcement Sets into named folders and subfolders, searchable via a Search box.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports up to five levels of subfolders under the Shared Enforcements folder, with create, rename, move (drag-and-drop), and delete operations.
    • Introduces system folders — All Enforcements, Shared Enforcements, Quick Actions, Findings Notification Enforcements, Predefined Enforcements sets, Drafts, System Enrichments, and Field Mappings — each with distinct rules on editability and deletion.
    • Enables moving one or more Enforcement Sets between folders via the More Actions menu (3-dot) on the Enforcement Sets table, with a Search Folders field in the destination picker.

    4 details in Everything

76. Axonius Release Notes 9.0.8 (2026-09-24) Sep 24, 2026 · issue 092

    Axonius 9.0.8 adds Network Connections visibility, six new adapters, ServiceNow template ticketing, and expanded static analysis CVE filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Exclude aged and version-unbound CVEs from static analysis to reduce noise across your device inventory — navigate to Static Analysis Enrichment Settings and enable the two date and version filters.
    📍In the Axonius console, go to Settings › Exposures › Static Analysis Enrichment Settings, enable Exclude CVEs without specific affected versions and 'Exclude CVEs published on or before [date]', set the date cutoff (e.g., 2015-12-31), then save.
    Investigate unexpected lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. between OT and IT devices by reviewing the new Network Connections page for risky cross-segment traffic.
    📍In the Axonius console, go to Cyber-Physical Assets › Network Connections to see the environment-wide connection map, then open a specific device's asset profile and select the Network Connections tab to trace inbound and outbound sessions by protocol and port.
    Restrict Recommended Actions ticket creation to ServiceNow so remediation owners receive auto-routed tickets without manual intervention.
    📍In the Axonius console, go to Exposures › Recommended Actions, open a template ticket flow, select ServiceNow as the ticketing destination, map the remediation owner to the configured ServiceNow connection, then save the template.
    • Adds three new filtering options to Static Analysis Enrichment Settings: Exclude CVEs without specific affected versions (default On for new customers, Off for existing), Exclude CVEs published on or before [date] (default date 2015-12-31 for new customers), and Exclude devices matching this query to remove matched devices from static analysis scope entirely.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Column Views - View and Column Views - Add role permissions to control access to column views in the Adapters area; predefined Admin and Owner roles have both enabled by default after upgrade.
    • Adds a Fetch pending status and Queued At column to Adapter Fetch History for connections queued and waiting for an available worker, with Terminate Fetch now also cancelling connections in Fetch pending status.
    • Adds Alerts as Incidents settings group to the CrowdStrike Falcon adapter, replacing the standalone Fetch Alerts as Incidents toggle with a group that includes a fetch toggle and an Alert statuses to fetch selector.
    • Adds Fetch Scan Ids, Fetch SAST Results, and Fetch API Security Results advanced settings to the Checkmarx One adapter for optional retrieval of SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. results and API Security risks from the last completed scan per project.

    +24 more show less

    • Adds Project Resources advanced setting to the Digital Ocean adapter to enrich Droplets, Load Balancers, and Kubernetes Clusters assets with their DigitalOcean Project ID and Project Name.
    • Adds Fetch Application Settings advanced setting to the Akamai Application Security adapter to retrieve application settings including account lock state and registration completion.
    • Adds Active Directory / LDAP - Static Role secret engine type support to HashiCorp Vault integration for retrieving current passwords for LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. static roles.
    • Introduces a new Network Connections page and per-device Network Connections tab for visibility into communication patterns across IT and OT environments, including protocols, ports, inbound/outbound connections, and cumulative connection counts.
    • Adds ServiceNow as a supported destination in the Recommended Actions ticket creation template flow, enabling automatic routing to assigned remediation owners via the same out-of-the-box template mechanism used for Jira.
    • Adds ARCON PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. adapter, fetching Users and Devices from ARCON Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded..
    • Adds CyberArk Certificate Manager - SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. adapter, fetching Certificates, Devices, and Users from CyberArk's certificate lifecycle management platform.
    • Adds LinkShadow adapter, fetching Devices and Users from the LinkShadow network detection and responsenetwork detection and responseNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. platform.
    • Adds ONESOURCE adapter, fetching Users and Groups from the Thomson Reuters ONESOURCE tax compliance platform.
    • Adds Tencent Cloud EdgeOne adapter, fetching Domains & URLs, Compute Services, Load Balancers, and Network/Firewall Rules from the Tencent Cloud edge security acceleration platform.
    • Adds Zadara zCompute adapter, fetching Devices, Compute Images, Disks, and Network/Firewall Rules from the Zadara zCompute cloud compute platform.
    • Adds support for configuring multiple CyberArk Vault instances in the Enterprise Password Manager, each with its own domain, port, Application ID, and API Prefix settings.
    • Adds configurable email response link expiration under General GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. Settings, with a default of 24 hours and a maximum of 120 hours.
    • Adds support for OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client credentials authentication to Custom Files and other file-based adapters when using URL/FTP as the file source, sending an Authorization: Bearer header automatically before each fetch cycle.
    • Adds support for fetching Users assets from Akamai Application Security, including email, role, team, lock state, and registration state.
    • Adds option to fetch email security grades (DMARC Grade, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. Grade, DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. Grade) for domains in the BitSight Security Ratings adapter.
    • Adds option to fetch tags assigned to network devices in the Cisco Catalyst Center adapter, supporting Category: Value format as key-value tags and unformatted tag names as key-only tags.
    • Adds option to make Username and Password fields optional in Cisco ISE connection configuration when pxGrid is enabled without credentials.
    • Adds support in Cisco Meraki adapter for fetching client SaaS application data, Meraki organizations as Accounts assets, networks and VLANs as Networks assets, and appliance NAT rules (port forwarding, 1:1 NAT, 1:Many NAT) as Cisco Meraki NAT Rule Firewall assets.
    • Adds option to filter fetched vulnerabilities by status in the CrowdStrike Falcon Discover adapter.
    • Adds option to limit rule-event enrichment to specific Rule IDs in the Exabeam Cloud adapter.
    • Adds option to fetch Dynatrace Application Settings, including IP allowlist, user account status, group permission, and platform-token status.
    • Adds option to fetch Invoices as Expenses in the Bill adapter, in addition to the existing Bills as Expenses fetch.
    • Checkmarx One adapter now fetches Business Applications.
    • Adds three new filtering options to Static Analysis Enrichment Settings: Exclude CVEs without specific affected versions (default On for new customers, Off for existing), Exclude CVEs published on or before [date] (default date 2015-12-31 for new customers), and Exclude devices matching this query to remove matched devices from static analysis scope entirely.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Column Views - View and Column Views - Add role permissions to control access to column views in the Adapters area; predefined Admin and Owner roles have both enabled by default after upgrade.
    • Introduces a new Network Connections page and per-device Network Connections tab for visibility into communication patterns across IT and OT environments, including protocols, ports, inbound/outbound connections, and cumulative connection counts.
    • Adds ARCON PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. adapter, fetching Users and Devices from ARCON Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded..
    • Adds CyberArk Certificate Manager - SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. adapter, fetching Certificates, Devices, and Users from CyberArk's certificate lifecycle management platform.

    +4 more show less

    • Adds LinkShadow adapter, fetching Devices and Users from the LinkShadow network detection and responsenetwork detection and responseNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. platform.
    • Adds ONESOURCE adapter, fetching Users and Groups from the Thomson Reuters ONESOURCE tax compliance platform.
    • Adds Tencent Cloud EdgeOne adapter, fetching Domains & URLs, Compute Services, Load Balancers, and Network/Firewall Rules from the Tencent Cloud edge security acceleration platform.
    • Adds Zadara zCompute adapter, fetching Devices, Compute Images, Disks, and Network/Firewall Rules from the Zadara zCompute cloud compute platform.

    20 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Maximum devices per API call and Number of days to advanced settings have been removed from the Exabeam Cloud adapter — existing configurations using these settings must be updated.
    • !The A10 Control adapter now requires the /api/v2 suffix in the Host Name or IP Address connection setting (e.g., https://a10control.example.com/api/v2); existing connections using the old format will break.
    • !The Bishop Fox adapter no longer creates Device assets from DNS records — the Devices from Domains, Devices from Subdomains, and Devices from Targets settings have been removed; existing connections are automatically upgraded to the corresponding URLs from Domains, URLs from Subdomains, or URLs from Targets settings.
    • !DefectDojo findings are now parsed as Application Resources instead of Application Services — existing queries, dashboards, and reports targeting Application Services must be updated to target Application Resources.
    • !The default number of parallel workers for Network Routes enrichment is reduced from 10 to 2; environments relying on the previous default throughput will need to explicitly set a higher value (up to 15) if needed.
    • !The CrowdStrike Falcon standalone Fetch Alerts as Incidents advanced setting has been replaced by the Alerts as Incidents settings group — existing adapter configurations referencing the old standalone setting must be reconfigured.
77. Axonius Release Notes 9.0.7 (2026-09-15) Sep 15, 2026 · issue 078

    Axonius 9.0.7 adds CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. Reconciliation workspace, 11 new adapters, Signature Mitigations for CVE findings, and Virtual Network Inspector management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Find Windows devices where the patch is more than 30 days old, using the new OS: Windows Patch Release Date enrichment field, to prioritize remediation of lagging endpoints.
    📍In the Devices page, create a new query with the filter: OS: Windows Patch Release Date is more than 30 days ago, then save and export the results to drive your patch compliance report.
    Enable collection of Application Settings from a Confluent cluster to gain visibility into ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.-based access control posture.
    📍In the Confluent adapter configuration, navigate to Advanced Settings and enable Fetch Application Settings (default: disabled), then save and run a fetch cycle to populate Application Settings assets.
    Switch the Druva adapter to the v2 Devices API to retrieve devices using the updated endpoint.
    📍In the Druva Cloud Platform adapter connection settings, set Devices API Version to version 2, then enable admin APIs in the Druva Console under Settings › Enable admin APIs, and trigger a fetch to populate updated device and Application Settings assets.
    • Adds a new CMDB Reconciliation workspace that automatically aggregates, validates, and pushes data to CMDBsCMDBsConfiguration Management Databases — structured stores that track IT assets, their attributes, and relationships; cyber tools use them to enrich alerts and map blast radius during incidents. with zero manual data entry, supporting audit-readiness and licensing compliance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds OS: Windows Patch Release Type and OS: Windows Patch Release Date enrichment fields (nested under the OS complex field) to Windows device records, updated daily from the Microsoft Windows Update catalog, enabling queries such as 'assets where patch release date is more than X days ago'.
    • Adds a new Earliest First Fetch Time field to the Vulnerability Repository and Aggregated Security Findings pages, recording the earliest first-fetch timestamp across all sources for each vulnerability.
    • Adds a new Network Inspectors page under Settings → System for Cyber-Physical Assets deployments, providing centralized management of Virtual Network Inspector appliances including add, token generation, token re-generation, and removal.
    • Adds a Custom Data Asset Source mechanism with a dedicated enforcement action that converts manually-entered custom data into a first-class adapter contribution, processed by the correlation engine with no defined retention period.

    +13 more show less

    • Adds 11 new adapters: DTS Identity (Users, Devices, Aggregated Security Findings, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Applications, Software), HPE Alletra SAN (Devices), Moody's CreditLens (Users), NetSPI Resolve (Devices), OneSpan (Users, Groups, Application Settings), Radware Cloud Services (Networks, Application Settings), SOCRadar (Devices, Networks, URLs, Certificates), Spacelift (Users, Application Settings), Ubiquiti UISP (Devices), UiPath (Users, Application Settings), and WordPress Toolkit (URLs, Aggregated Security Findings, SaaS Applications).
    • Adds Fetch Application Settings advanced setting (default: disabled) to the Confluent adapter, which fetches Application Settings assets from Confluent cluster ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. when enabled.
    • Adds Devices API Version connection setting to the Druva Cloud Platform adapter, allowing selection between version 1 (default) and version 2 of the Druva Devices API.
    • Adds Application Settings support to the Druva Cloud Platform adapter, fetching administrator roles and statuses from the Druva administrators API and evaluating audit event availability.
    • Adds support for the fortinet:fortigate entity type in the Dynatrace adapter, mapping those entities to Device assets in Axonius.
    • Adds support for fetching Domains & URLs for CloudFront distribution aliases in the AWS adapter, linking each alias to its CloudFront distribution for inclusion in Internet Exposure queries.
    • Adds Application Settings asset type support to the AppViewX CERT adapter, fetching authentication, access control, credential, key rotation, logging, retention, login, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., SSH connection, and service account settings.
    • Adds an upper-bound detection date advanced setting to the Cynerio adapter for more granular control over the time range when fetching risks and vulnerabilities.
    • Adds Single Account / All Organization Accounts selection to the DocuSign adapter, with a new Organization ID field to discover and collect data across all accounts in a DocuSign organization.
    • Adds an optional Is File setting to Delinea Privilege Manager (Thycotic) Vault secret references, causing Axonius to retrieve file content instead of the field value when enabled.
    • Reclassifies Datadog host records tagged with aws:lambda or functionname: as Serverless Function assets instead of Device assets.
    • Enables admins to set a default view per role for specific Assets pages, automatically applied when a user with that role opens the page.
    • Makes destination endpoint fields in Remediation Ownership configuration optional, allowing remediation owners to be assigned to Security Findings without providing endpoint details.
    • Adds a new CMDB Reconciliation workspace that automatically aggregates, validates, and pushes data to CMDBsCMDBsConfiguration Management Databases — structured stores that track IT assets, their attributes, and relationships; cyber tools use them to enrich alerts and map blast radius during incidents. with zero manual data entry, supporting audit-readiness and licensing compliance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds OS: Windows Patch Release Type and OS: Windows Patch Release Date enrichment fields (nested under the OS complex field) to Windows device records, updated daily from the Microsoft Windows Update catalog, enabling queries such as 'assets where patch release date is more than X days ago'.
    • Adds a new Earliest First Fetch Time field to the Vulnerability Repository and Aggregated Security Findings pages, recording the earliest first-fetch timestamp across all sources for each vulnerability.
    • Adds a new Network Inspectors page under Settings → System for Cyber-Physical Assets deployments, providing centralized management of Virtual Network Inspector appliances including add, token generation, token re-generation, and removal.
    • Adds a Custom Data Asset Source mechanism with a dedicated enforcement action that converts manually-entered custom data into a first-class adapter contribution, processed by the correlation engine with no defined retention period.

    +2 more show less

    • Adds 11 new adapters: DTS Identity (Users, Devices, Aggregated Security Findings, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Applications, Software), HPE Alletra SAN (Devices), Moody's CreditLens (Users), NetSPI Resolve (Devices), OneSpan (Users, Groups, Application Settings), Radware Cloud Services (Networks, Application Settings), SOCRadar (Devices, Networks, URLs, Certificates), Spacelift (Users, Application Settings), Ubiquiti UISP (Devices), UiPath (Users, Application Settings), and WordPress Toolkit (URLs, Aggregated Security Findings, SaaS Applications).
    • Enables admins to set a default view per role for specific Assets pages, automatically applied when a user with that role opens the page.

    11 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Citrix ADC adapter no longer publishes Network Route assets for NAT rules; NAT translations now appear on Load Balancer assets instead. Existing queries, reports, or enforcement workflows targeting Network Route assets from Citrix ADC NAT must be updated to use NAT translations on Load Balancer assets.
78. Axonius Release Notes 9.0.6 (2026-09-03) Sep 3, 2026 · issue 064

    Axonius 9.0.6 adds Jira ticketing from asset queries, Risk Scores for sub-assets, Okta Universal Logout, three new adapters, and expanded enrichment controls.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Exclude noisy internal zones from Network Routes enrichment to reduce discovery cycle overhead.
    📍In Axonius, go to Settings › Network Routes, enable Network Routes Enrichment, and enter zone names (e.g. DMZ, Lab) in the Zones to Exclude field.
    Define how many recent major OS versions are treated as supported so the Is Supported OS Version Device field reflects your organisation's patching policy.
    📍In Axonius, go to Settings › Enrichment, locate Number of Supported Major OS Versions, and set the value for each OS type you want to override (default is 1).
    Fetch Cisco Catalyst Center license compliance and Smart Account pool metrics alongside device inventory.
    📍In the Cisco Catalyst Center adapter settings, open Advanced Settings and enable Fetch Licenses. On the next discovery cycle, License assets appear and device records are enriched with expiry status, feature license details, and account pool metrics.
    • Adds Number of Supported Major OS Versions setting under Settings > Enrichment, which controls how many recent major OS versions are considered supported per OS type and populates the Is Supported OS Version Device field (default: one supported major version per OS type).
    • Adds two new global Network Routes enrichment settings: Network Routes Enrichment (enables/disables the enrichment pipeline during discovery cycles) and Zones to Exclude (names of zones whose subnets are excluded from enrichment).
    • Adds Fetch Licenses advanced setting to the Cisco Catalyst Center adapter, creating License assets and enriching device records with expiry status, feature license details, and Smart Account pool usage metrics.
    • Adds Fetch Application Settings advanced setting to the Datadog adapter, fetching account-, user-, and role-level settings — including ownership, domain and IP allowlists, governance notifications, identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., roles, sensitive-data scanning, and user settings — as Application Settings assets.
    • Adds Fetch application settings advanced setting to the Elasticsearch adapter, fetching cluster settings, API keys, users, and security settings as Application Settings assets.

    +27 more show less

    • Adds Fetch Application Settings advanced setting to the Keycloak adapter, fetching realm settings and user-profile settings as Application Settings assets.
    • Adds Fetch Application Settings advanced setting to the Harness adapter, fetching authentication mechanisms, role assignments, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. configuration, session timeouts, and security policies as Application Settings assets.
    • Adds Account ID connection setting to the Dell Boomi adapter (required to enable Application Settings fetching); existing connections without an Account ID continue to fetch only Devices data.
    • Adds Gateway as a selectable option in the HPE Aruba Networking Central Devices type to fetch advanced setting, with configurable concurrent gateway detail requests (1–25) and a new API rate limit setting (max calls per second).
    • Adds Parse Records with Status Name Starting with 'App' as Business Applications advanced setting to the IFS Assyst adapter.
    • Adds two new options to the Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. / Intune Fetch users Last Sign-In - How to fetch advanced setting: non-interactive sign-ins (token refreshes, background service authentications) and automated processes.
    • Adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Token authentication (OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Client ID and Client Secret) as an alternative to API Key in the RUCKUS Cloud adapter.
    • Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Client Credentials authentication as an alternative to API Key in the BeyondTrust Password Safe adapter.
    • Adds API Key authentication as an alternative to username/password for the Check Point Infinity adapter when connecting to a Management Server.
    • Adds ISPSS authentication support to the CyberArk Endpoint Privilege Manager adapter (Identity Administration sub-domain and EPM API application alias).
    • Adds the option to fetch Saviynt accounts as Account/Tenant assets from the getAccounts endpoint, with optional filtering to Active status, and entitlement details per user from the getEntDetailsforUsers endpoint.
    • Adds the State field (active or archived) and a new advanced setting to exclude devices with no or empty Last Seen value to the FortiDLP adapter.
    • Adds option to fetch Google Cloud Artifact Registry repositories as Compute Services assets in the GCP adapter.
    • Adds option to filter fetched devices by Organization ID in the DNSFilter adapter.
    • Adds option to fetch extended Gateway details (serial number, model, OS, status, group name, uplink) in HPE Aruba Networking Central, consuming one additional API call per Gateway.
    • Adds HPE fallback Device Manufacturer value advanced setting and Device Manufacturer population from physical server chassis data to the HPE OneView adapter.
    • Adds option to set the Last Seen value of Devices or Users to the current time in the Custom Files adapter.
    • Adds Dell Boomi Application Settings as a new asset type exposing authentication methods, user privileges, and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning status.
    • Adds Effecte advanced setting to exclude application installation records marked as hidden from Installed Software.
    • Replaces the ServiceNow Parse operational status advanced setting with configurable Custom Parsing rules; existing enabled configurations are automatically migrated to two equivalent rules covering Operational Status and Asset Operational Status fields.
    • Introduces new ticketing flow allowing users to open one or more Jira tickets directly from selected assets or an entire query result, with pre-filled content from asset data, a rich-text editor supporting dynamic value tokens, a live ticket count preview, and a Test Tickets option against a single sample asset.
    • Extends the new ticketing flow to the Recommended Actions page, with additional controls to include or exclude specific groups of Security Findings (e.g. those missing ownership data) and to group findings by one or more asset fields to control ticket count.
    • Enables Risk Score configuration for sub-assets (e.g. Network Devices, Repositories); when both a sub-asset and its parent asset have a Risk Score configured for the same asset or Security Finding, the sub-asset score takes precedence.
    • Adds dynamic charts to the Remediation Ownership page showing Security Findings per owner and Owned vs. Unowned Security Findings distribution, and to the Recommended Actions page showing actions per remediation owner and distribution of action sub-types.
    • Adds Okta Universal Logout support, enabling Okta Identity Threat Protection (ITP) to immediately terminate active Axonius user sessions on detected security risks such as compromised credentials or session hijacking.
    • Adds three new adapters: DataDome (bot protection, fetches Business Applications and Firewalls), Zentral (endpoint visibility for Apple/Linux/Android, fetches Devices and Users), and Zero Touch (unified endpoint management, fetches Devices).
    • Updates the Arnica.io adapter to retrieve repository information directly from the /v1/inventory/repos endpoint instead of aggregating it from findings data.

    32 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Cisco Firepower Management Center adapter no longer fetches ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. table data from firewall devices; the Fetch ARP table from firewall devices advanced setting has been removed. Access and NAT firewall rule assets no longer include a policy device name in their asset ID or firewall name.
    • !The CrowdStrike Falcon advanced setting Enrich Configuration Assessment with Rule Name is renamed to Enrich Configuration Assessment with Rule Information; any saved references to the old name must be updated.
79. docs update Aug 20, 2026 · issue 051

    Axonius Ingestion Rules gain post actions — skip_field, remove_values, remove_items, trim_prefix/suffix/regex, and set_value — for pre-ingest data shaping

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Drop PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. fields (e.g., physical location and agent ports) from every device ingested by an adapter.
    copy

    $ device key_exists ["id"] then skip_field ["physical_location", "qualys_agent_ports"]

    Strip a MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. suffix appended to EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. hostnames so the ad_hostname field contains only the clean hostname.
    copy

    $ device key_exists ["id"] then trim_regex ad_hostname ["-([A-Fa-f0-9]{2}(:[A-Fa-f0-9]{2}){5})"]

    Extract the hostname from a device remote URL into a dedicated host field for easier querying and reporting.
    copy

    $ device.remote_url key_exists ["id"] then set_value host = regex_extract(device.remote_url, "https?://([^/]+)", 1)

    • Adds skip_field post action to remove specified fields from an entity before ingestion, preventing them from being written to the database (e.g., device key_exists ["id"] then skip_field ["physical_location", "qualys_agent_ports"]).
    • Adds remove_values post action to drop specific values from list fields or list-object fields before ingestion, supporting operators like starts_with, ==, etc.
    • Adds remove_items post action to drop entire list items (e.g., full network interface entries) when a subfield condition matches, using syntax like then remove_items network_interfaces.ip4 in_net ["10.20.0.0/24"].
    • Adds trim_prefix and trim_suffix post actions to strip a literal prefix or suffix from a field value during ingestion.
    • Adds trim_regex post action to remove a regex-matched substring from a field value, with case-insensitive support via (?i) prefix.

    +5 more show less

    • Adds set_value post action to create or overwrite a field on an entity at ingest time, supporting static literals (strings, booleans, integers), field references (dotted paths), and transform functions (trim_prefix, trim_suffix, trim_regex, regex_extract).
    • Adds regex_extract transform inside set_value to extract a capture group from a field value into a new or existing field, with a capture-group index argument (default: 1).
    • When set_value overwrites an existing value, Axonius automatically preserves the previous value in a new field named <field>_original.
    • Adds support for key_exists and key_not_exists operators directly inside post action conditions, enabling post actions that fire only when a field value is present or absent.
    • Post actions are chained to primary Ingestion Rule statements using the then keyword, making them optional additions to any existing rule.

    10 details in Everything

80. docs update Aug 20, 2026 · issue 051

    Axonius documents the full operator set for ingestion rule primary statements, including IP, regex, and cross-field comparisons.

    ⤢ ⤢ ⤢
    └──▷ USE IT
    Exclude low-confidence OS data during ingestion — skip OS fields for any device whose confidence score is below 65.
    text copy

    device.confidence_level < 65 then skip_field ["os.type", "os.distribution", "os.type_distribution", "os.os_str"]

    Filter ingestion to devices whose IP is inside a specific corporate subnet, using the in_net CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. operator.
    text copy

    device.network_interfaces.ips in_net ["10.10.11.0/24"]

    Ingest only active users by requiring last logon within the past 10 days, using a relative date expression.
    text copy

    user.last_logon > date(now-10d)

    • Adds == / != (equal/not equal) operators for ingestion rule primary statements, with a noted behavior: asset.key != "value" only matches assets where the field exists, requiring key_not_exists to also capture missing fields.
    • Adds < / > date comparison operators supporting date(YYYY-MM-DD), date(now-nd), and date(now+nd) syntax; >= / <= are explicitly unsupported for dates.
    • Adds <, >, >=, <= numeric comparison operators for ingestion rule conditions (e.g., device.confidence_level < 65).
    • Adds in / not_in operators to check whether a field value is in or not in a list.
    • Adds in_net / not_in_net operators to check whether an IP address or subnet falls within a CIDR range, supporting both IPv4 and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only..

    +6 more show less

    • Adds starts_with / not_starts_with and ends_with / not_ends_with pattern-matching operators for string fields.
    • Adds key_exists / key_not_exists operators to check presence or absence of all supplied field keys.
    • Adds field_equal / field_not_equal operators to compare the value of one entity field against another field on the same entity.
    • Adds field_starts_with / field_not_starts_with operators to compare whether one field's value starts with another field's value on the same entity.
    • Adds contains / not_contains case-insensitive substring operators.
    • Adds match_regex / not_match_regex operators to match field values against a regex pattern.

    11 details in Everything

81. docs update Aug 20, 2026 · issue 051

    Axonius adds Ingestion Rules configuration: filter, combine, and test which adapter data enters the platform per connection.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Apply a complex filter so only assets matching rule 1 AND either rule 2 or rule 3 are ingested from an adapter connection.
    📍In Adapters, open the adapter › Advanced Settings › Ingestion Rules Configuration. Toggle on 'Enable ingestion rules to configure which data to ingest from the adapter into the system'. Set Select logical operator for all rules to Custom. In the Custom Logical Expression field enter: 1 AND (2 OR 3). Click Save.
    Configure different ingestion rules for each adapter connection, then immediately test them with a fetch.
    📍In Adapters, open the adapter › Advanced Settings › Ingestion Rules Configuration. Toggle on 'Enable ingestion rules settings for each connection separately'. Click Save. Then click Add Connection, select the Ingestion Rules Configuration tab, toggle on 'Enable ingestion rules to configure which data to ingest from the adapter into the system', configure the rules, and click Save and Fetch.
    • Adds Ingestion Rules Configuration page under Advanced Settings for each adapter, with a toggle to enable rules that control which entities are ingested from the adapter into Axonius.
    • Supports OR, AND, and Custom logical operators (selectable via Select logical operator for all rules drop-down) to combine multiple ingestion rule statements.
    • Adds a Custom Logical Expression field (activated when Custom operator is selected) accepting parenthesized boolean expressions of rule numbers (e.g. 1 AND (2 OR 3), (1 OR 2) AND (3 OR 4)) — AND/OR keywords are case-sensitive and must be uppercase.
    • Enables per-connection ingestion rule configuration via the Enable ingestion rules settings for each connection separately toggle, which adds an Ingestion Rules Configuration tab to the Add Connection drawer.
    • Adds Save and Fetch action on the Add Connection page to immediately test ingestion rules; results visible in the Query Wizard using From Last Fetch - yes and in Adapter Fetch History showing assets ignored before and after rules.

    +1 more show less

    • Entities excluded by ingestion rules remain in Axonius until the configured Delete devices (or users) and other assets that have not been returned from the source in the last X hours retention window expires.

    6 details in Everything

82. docs update Aug 20, 2026 · issue 051

    Axonius adds parallel connection fetching control for scheduled adapter discovery cycles.

    ⤢ ⤢ ⤢ ⤢
83. Axonius Release Notes 9.0.5 (2026-08-20) Aug 20, 2026 · issue 051

    Axonius 9.0.5 adds OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. for service accounts, GitHub Advisory Database CVE enrichment, parallel adapter fetching, and 7 new adapters.

    ⤢
    └──▷ HOW TO FIND IT
    Enable GitHub Advisory Database enrichment to supplement CVE data with CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3/v4, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and exploit availability details for software vulnerabilities.
    📍In the Axonius console, go to Settings › Enrichment › CVE Enrichment Settings, toggle on 'Enrich software vulnerabilities from GitHub Advisory Database', then select Fetch GitHub Reviewed Advisories for curated coverage.
    Speed up discovery for adapters with many connections by enabling parallel fetching in Adapter Discovery Configuration.
    📍In the Axonius console, go to the adapter settings for a supported adapter (e.g., Salesforce or VMware ESXi), open Adapter Discovery Configuration, and set 'Number of connections to fetch in parallel' to the desired concurrency value (e.g., 5).
    • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 authentication support for service accounts; access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. are issued via the /api/oauth2/token endpoint and invalidated automatically on credential reset or new token generation.
    • Adds Number of connections to fetch in parallel setting under Adapter Discovery Configuration to enable parallel connection fetching for Claroty CTD, F5 BIG-IP iControl, Infoblox DDI, Salesforce, VMware ESXi, and vSphere adapters.
    • Adds Workstation OS Types to Exclude setting to Network Routes Enrichment Configurations in Global Settings to exclude specific device operating systems from enrichment.
    • Adds Include only mode for field-level adapter scoping in data scopes alongside the existing Exclude mode, with updated labels distinguishing Define asset access by adapter connection from Define field access by adapter connection.
    • Extends vault (Enterprise Password Manager) integration to support sensitive file fields including client certificate files (.pem), client private key files (.pem), advanced configuration files (JSON/XML), and credentials-format files — in addition to existing password fields.

    +15 more show less

    • Adds a new Range operator for IPv4 field filters in the Query Wizard, enabling From-To IP address range searches.
    • Changes data scope behavior so selecting all individual connections for an adapter no longer auto-upgrades to adapter-wide selection; the adapter parent checkbox must be explicitly selected to include current and future connections.
    • Adds monthly recurrence options for historical snapshot scheduling: first day of month, last day of month, or a specific calendar day.
    • Adds an Impersonated by field to HTTP activity logs, recording both the acting user and the impersonated user for all actions taken during an impersonation session.
    • Updates default value for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate verification (Verify SSL) from disabled to enabled for all new adapter connections.
    • Adds CSV export for all chart visualization types — Bar, Pie, Donut, Stacked Bar, Line, Table, and Venn — across all compatible widgets, including count and percentage values, a Total row, full numeric values, and filenames in the format Axonius - [Chart Name] - DD Month YYYY, HH.MM AM/PM.csv.
    • Introduces a unified custom data editing panel on the asset table replacing separate Create and Edit dialogs, with bulk-edit support for updating shared fields across multiple assets simultaneously.
    • Adds 7 new adapters: Black Duck Polaris (Aggregated Security Findings, Application Resources, Business/SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Applications), Cisco IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Control Center (Devices), Invicti Platform Cloud (Aggregated Security Findings, Business/SaaS Applications, URLs), Mashery/Boomi Cloud API Management (Application Services, Business Applications, Organizational Units, Secrets, Security Roles, URLs, Users), Mindtickle (Groups, Users), Smart SD (Devices), and StrongDM (Devices).
    • Adds Enrich certificates with discovery data advanced setting and Discovery Name field to AppViewX CERT adapter for enriching certificates with cipher, TLS version, and port scan data.
    • Adds Connection Method setting to Cisco ASA adapter to choose between Legacy REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and HTTP Interface, required for Cisco Firepower 2100 and 2120 models.
    • Adds API Gateway support to Cisco Identity Services Engine (ISE) adapter for routing requests through Layer7 or IBM API Connect gateways.
    • Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. (Oracle Cloud Infrastructure) account type to CrowdStrike Falcon CSPM Account / Tenants Settings advanced setting, enabling ingestion of OCI tenancy name, tenancy OCID, home region, user information, and CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. Status.
    • Adds Software asset fetching from CSV and JSON files to the Custom Files adapter, and adds configurable custom field delimiter support for CSV files (e.g., semicolon or pipe instead of default comma); SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. file retrieval now supports Distributed File System (DFS) paths.
    • Adds Certificate advanced setting to Certero adapter (enabled by default) allowing users to disable fetching of Certificate assets.
    • Adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. parsing option to Azure Defender for IoT adapter for Guess (uncertain) MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. identified by Azure Defender for IoT detection algorithms.

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Data scope behavior change: selecting all individual connections for an adapter no longer automatically upgrades to an adapter-wide selection; new connections added to the adapter will not be automatically included unless the adapter parent checkbox is explicitly selected.
84. Axonius Release Notes 9.0.5 (2026-08-20) Aug 20, 2026 · release notes

    Axonius 9.0.5 adds GitHub Advisory enrichment, OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. for service accounts, parallel adapter fetching, and new assets like Black Duck Polaris.

    └──▷ HOW TO FIND IT
    Ingest vulnerability data from GitHub Advisory Database for CVE enrichment in your cyber tooling.
    📍Navigate to Settings › Enrichment › CVE Enrichment Settings, toggle on 'Enrich software vulnerabilities from GitHub Advisory Database', and select advisories to fetch.
    Configure OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 for a service account to authenticate via client ID/secret and token endpoint.
    📍Open the service account drawer, select OAuth 2.1 as authentication method, generate client ID/secret, and verify tokens are issued via /api/oauth2/token.
    Use the new Range operator in Query Wizard to find assets with IPv4 addresses in a specific subnet range.
    📍In Query Wizard, select an IPv4 field, choose Range from the operators dropdown, and enter 192.168.1.0 to 192.168.1.255.
    • Adds OAuth 2.1 authentication support for service accounts, automatically generating client ID and secret and issuing tokens via /api/oauth2/token when selected in the service account drawer.
    • Adds Number of connections to fetch in parallel setting in Adapter Discovery Configuration to control simultaneous connection processing for Claroty CTD, F5 BIG-IP iControl, Infoblox DDI, Salesforce, VMware ESXi and vSphere adapters.
    • Enables CSV export for all visualization types (Bar, Pie, Donut, Stacked Bar, Line, Table, Venn) across compatible widgets, including count/percentage values, a Total row, full numeric values, and title-cased headers.
    • Introduces Range operator in Query Wizard for IPv4 fields to search assets within a specified IP address From-To range.
    • Adds unified Custom Data Editing panel on Assets Pages allowing Create, Edit, or Bulk edit of custom fields directly from the asset table without switching dialogs.

    +20 more show less

    • Updates default SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate verification to enabled (Verify SSL) for all new adapter connections as a security enhancement.
    • Adds Impersonated by field to HTTP Activity Logs to record both acting and impersonated users during impersonation sessions.
    • Adds monthly recurrence options (first day, last day, specific calendar day) for Historical Snapshot scheduling alongside existing interval and day-of-week settings.
    • Introduces separate adapter-level and connection-level data scope selection, including Include only mode for field-level scoping to show only fields from selected adapters.
    • Adds ability to retrieve sensitive file fields (client certificates, private keys, JSON/XML configs) from configured password managers during adapter connection setup.
    • Adds Workstation OS Types to Exclude setting in Network Routes Enrichment Configurations to improve performance by excluding specific OS types from enrichment.
    • Introduces new Black Duck Polaris adapter fetching Aggregated Security Findings, Application Resources, Business Applications, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Applications.
    • Introduces new Cisco IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Control Center (IoTCC) adapter fetching Devices.
    • Introduces new Invicti Platform Cloud adapter fetching Aggregated Security Findings, Business Applications, SaaS Applications, and URLs.
    • Introduces new Mashery (Boomi Cloud API Management) adapter fetching Application Services, Business Applications, Organizational Units, Secrets, Security Roles, URLs, and Users.
    • Introduces new Mindtickle adapter fetching Groups and Users.
    • Introduces new Smart SD adapter fetching Devices.
    • Introduces new StrongDM adapter fetching Devices.
    • Adds Enrich certificates with discovery data advanced setting to AppViewX CERT adapter for enrichment with cipher, TLS version, and port scan data.
    • Adds support for parsing Guess MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. in Azure Defender for IoT adapter via a new advanced setting option.
    • Adds Certificate advanced setting to Certero adapter to disable fetching Certificate assets.
    • Adds Connection Method setting to Cisco ASA adapter to choose between Legacy REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and HTTP Interface for Firepower 2100/2120 models.
    • Adds support for connecting to Cisco ISE through an API Gateway (Layer7 or IBM API Connect) in the Cisco ISE adapter.
    • Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. account type to CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. Account / Tenants Settings advanced setting in CrowdStrike Falcon adapter for OCI tenancy data ingestion.
    • Enables Custom Files adapter to fetch Software assets from CSV and JSON files, supports custom field delimiters for CSV, and DFS paths for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. retrieval.

    25 details in Everything

85. docs update Aug 17, 2026 · issue 048

    Axonius now lets practitioners create asset records manually from the table view.

    ⤢ ⤢ ⤢ ⤢
86. Axonius Release Notes 9.0.4 (2026-08-06) Aug 6, 2026 · release notes

    Axonius 9.0.4 adds Threat Intel fields, bulk workflows, OT scanning, and many new adapters

    └──▷ HOW TO FIND IT
    Scan incomplete OT devices in batches using rate-controlled active discovery
    📍In Device Intelligence Hub: Create Query-Based Scan Job -> Select Scope -> Schedule -> Enable Rate Control for BACnet/Modbus/CIP
    Process multiple assets in one workflow execution without hitting ceilings
    📍Workflow Designer: Add Repeat For Each node -> Iterate over multi-asset query results -> Use per-asset logic or aggregate into single ticket
    Fetch network routes including DNAT/SNAT from Citrix NetScaler appliances
    config copy

    Citrix ADC Adapter Settings -> Enable 'Fetch NAT Rules' advanced setting

    • Adds Exploitation Status field from Axonius Threat Intelligence to prioritize CVEs based on real-world activity
    • Introduces Device Intelligence Hub for Cyber-Physical Assets with rate-controlled active scanning for BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. (UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. 47808), Modbus (TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. 502), and CIP (TCP 44818)
    • Enables Repeat For Each workflow node to process large asset lists in a single bulk run
    • Adds Partially Successful status and per-asset tracking to Action Center workflow nodes
    • Increases adapter discovery scheduling limit via the Repeat scheduled discovery every (hours) setting from 24 to 48 hours

    +12 more show less

    • Supports Azure Cloud Environment selection for Azure Key Vault integration to auto-construct correct Key Vault URIs
    • Adds A10 ThreatX, BD Alaris, Blancco, GlobalSign GCC, HarfangLab, Personio, Philips PerformanceBridge Focal Point, Tanium Reporting, and TXOne StellarOne adapters
    • Adds DNS zones (as Network Services), GTM domains (as Load Balancers), and authentication settings to Akamai and Auth0 adapters
    • Enables query-driven scanning for Axonius BACnet Scanner, CIP Scanner, and Modbus TCP Scanner
    • Adds Fetch NAT Rules advanced setting to Citrix ADC adapter to retrieve inbound (DNAT) and reverse (SNAT) rules
    • Adds Remove Mapped Keys connection parameter and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. latest-file download support to Custom Files adapter
    • Enables enrichment of user Last Seen data from Entity User endpoint in Delinea Privileged Remote Access
    • Adds GitGuardian Occurrence Details advanced setting for detailed secret detection metadata
    • Allows custom Intrigue instance connection via new optional Domain setting
    • Adds Violations Pagination Page Limit to JFrog Xray adapter
    • Exports and imports asset profile page dashboards in JSON format
    • Makes imported queries inherit destination folder visibility (Private, Public, Shared) instead of forcing Public

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Google Workspace adapter now requires additional OAuth scope https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly for Enrich Browser Extensions
    • !Azure Key Vault integration now requires explicit selection of Azure Cloud Environment (Public, US Government, US Government DoD, China, or German)
87. docs update Jul 27, 2026 · issue 027

    Axonius 9.0 introduces a redesigned grouped navigation with expandable menu groups replacing the previous icon-based side menu.

    └──▷ HOW TO FIND IT
    Navigate to Cases or Case Sets after upgrading to the new grouped navigation in v9.0.
    📍In the console, go to the side menu › Action Center group › Cases (or Case Sets).
    Access Activity Log or Nodes under the new System group after enabling the v9.0 navigation experience.
    📍In the console, go to the side menu › System group › Activity Log (or Nodes).
    • New grouped navigation experience in v9.0 organizes all side-menu items into expandable groups, replacing the icon-based navigation.
    • Cases and Case Sets are now accessible directly from the new Action Center group in the side menu.
    • Activity Log and Nodes are now accessible from the new System group in the side menu.
    • Monitoring page gains a blue notification dot on its side-menu icon when new alerts appear, cleared on page visit.

    4 details in Everything

88. docs update Jul 27, 2026 · docs issue 004

    Axonius 9.0 introduces a redesigned grouped navigation with expandable menu groups replacing the previous icon-based side menu.

    └──▷ HOW TO FIND IT
    Navigate to Cases or Case Sets after upgrading to the new grouped navigation in v9.0.
    📍In the console, go to the side menu › Action Center group › Cases (or Case Sets).
    Access Activity Log or Nodes under the new System group after enabling the v9.0 navigation experience.
    📍In the console, go to the side menu › System group › Activity Log (or Nodes).
    • New grouped navigation experience in v9.0 organizes all side-menu items into expandable groups, replacing the icon-based navigation.
    • Cases and Case Sets are now accessible directly from the new Action Center group in the side menu.
    • Activity Log and Nodes are now accessible from the new System group in the side menu.
    • Monitoring page gains a blue notification dot on its side-menu icon when new alerts appear, cleared on page visit.

    4 details in Everything

89. docs update Jul 24, 2026 · issue 024

    Axonius Users page gains a Preferred Last Seen field showing the most recent last_seen timestamp across all adapters.

90. docs update Jul 24, 2026 · docs issue 004

    Axonius Users page gains a Preferred Last Seen field showing the most recent last_seen timestamp across all adapters.

91. Axonius Release Notes 9.0.3 (2026-07-22) Jul 22, 2026 · issue 040

    Axonius 9.0.3 adds 7 new adapters, a Preferred Last Seen user field, Security Finding count fields by risk level, and dozens of adapter and enforcement enhancements.

    └──▷ HOW TO FIND IT
    Query devices in the Devices table to surface those with the most critical open security findings, including non-CVE findings, for prioritized remediation.
    📍In the Devices table, add the columns Total SF Count: Critical Axonius Risk Level and Total SF Count: High Axonius Risk Level, then filter where Total SF Count: Critical Axonius Risk Level › 0 to identify devices with open critical Security Findings.
    Export Jira tickets with team ownership pre-assigned so triage routing happens at ticket creation, not after.
    📍In the Enforcement Center, open a Jira Software - Create Ticket action, scroll to the optional Team parameter, enter your team name, and save — newly created tickets will carry that team assignment.
    Include a timestamp column in SQL asset exports so downstream pipelines can track when each row was written.
    📍In the SQL - Send Assets to Table enforcement action, enable Add Timestamp Column and set Timestamp Column Name to a value such as axonius_export_ts before running the action.
    • New AI Recommended Action Plans optional field in the Recommended Actions table enables exporting detailed AI-generated action plans to CSV.
    • New Total SF Count: Critical/High/Medium/Low Axonius Risk Level fields on the Devices table let users query and count non-CVE Security Findings by risk level.
    • Checkmarx SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. adapter adds an optional OData API connection method as an alternative integration path, configurable via a new connection setting.
    • IBM QRadar adapter adds a new Incidents asset type that fetches QRadar offenses, plus three new advanced settings for time-based and status-based offense filtering; devices are now enriched with related offense information.
    • ServiceNow adapter adds a new Custom HTTP Headers connection setting with method and URL pattern filtering support.

    +41 more show less

    • Snyk adapter adds an option to select the Vulnerable Software ingest mode: ingest as CVEs, as Snyk Issue IDs, or both.
    • SQL - Send Assets to Table enforcement action adds new Add Timestamp Column and Timestamp Column Name parameters for including a configurable timestamp column in exported SQL tables.
    • Axonius - Enrich DNS Custom Data enforcement action adds support for A, AAAA, and PTR DNS record types, plus new DNS Server and Query TTL parameters.
    • ServiceNow - Create Incident and Create Incident per Asset enforcement actions now output Incident Number, Opened At, and Short Description as additional artifacts, and support custom HTTP headers.
    • Jira Software - Create Ticket and Create Ticket Per Asset enforcement actions add a new optional Team parameter for team ownership assignment.
    • ManageEngine ServiceDesk Plus - Create Request adds a new Exclude Axonius notes from request description parameter.
    • Gateway install packages can now be downloaded via a curl command by clicking Create and Copy curl command in System Settings and supplying an API Key and API Secret.
    • New adapter: CrowdStrike Adaptive Shield (AI-powered SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.) — fetches Audit Activities, Devices, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Applications, Software, Users.
    • New adapter: Entro Security (non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. and secrets management) — fetches Users, Secrets.
    • New adapter: Lark/Feishu (collaboration and HR platform) — fetches Users.
    • New adapter: Microsoft Windows DNS Server — fetches Network Services.
    • New adapter: Nudge Security (SaaS management platform) — fetches Application Addons, SaaS Applications, Application Addon Instances, Admin Managed Extensions, Admin Managed Extension Instances, Users, User Initiated Extension Instances, User Initiated Extensions, Extensions, Application Keys, User Extensions.
    • New adapter: SAP S/4HANA (On-Prem) — fetches Users.
    • New adapter: Sweet Security (runtime CNAPPCNAPPA cloud-native application protection platform that combines checks across cloud configuration, workloads and development. It helps teams connect risks that separate tools might report apart. via eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.) — fetches Devices.
    • New Preferred Last Seen aggregated field on the Users table shows the most recent last_seen timestamp across all adapters for a given user.
    • 1E adapter adds an optional JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Audience (AUD) connection parameter for JWT-based authentication.
    • Akamai CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. Cloud adapter adds two new optional enrichment endpoints for Origin Type and Origin Server Hostname fields.
    • Akamai Kona WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adapter adds a new optional Fetch Property Versions advanced setting that retrieves Latest Version Updated By and other version-related metadata.
    • Archer IRMIRMInsider Risk Management: a discipline focused on detecting and responding to threats from employees or contractors with legitimate access, giving cyber tools behavioral analytics and policy-enforcement hooks for internal actors. adapter adds a configurable Devices Page Size advanced setting with a range of 50–1000 and a default of 200.
    • Atlassian adapter adds Atlassian Teams as a new Group asset type.
    • Axonius BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. Scanner adapter adds a new optional BACnet Network ID connection setting for remote network discovery through routers.
    • Cisco adapter adds a new optional Fetch Firewall Rules advanced setting that retrieves ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. and NAT rules.
    • Cisco CX Cloud adapter adds the option to enrich hardware and network elements with Field Notices.
    • Custom Files and other file-based adapters now support KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application./GSSAPI authentication for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. Share connections (SMB v2 and v3); supported adapters include Bently Nevada, BIND DNS, Bloomberg BPKG, CSV Network Services, Honeywell Experion, Honeywell FSC PDF, Honeywell TDC 3000, Huawei iMaster MAE, Rockwell FactoryTalk, Schneider Electric Triconex, Steel Cloud, Steel Cloud CVX, and Yokogawa BK Rev Info.
    • Delinea Privileged Remote Access adapter adds an optional Platform Users endpoint for cloud instances.
    • Docebo adapter adds an Enrich Users with Certifications option that fetches certification awards from the Docebo certifications endpoint.
    • Dynatrace adapter adds five new vulnerability fields: Dynatrace Exposure, Data Assets, Davis Risk Level, Davis Risk Score, and Dynatrace Vulnerable Components.
    • Infoblox DDI adapter adds an option to skip fixed addresses with no MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet., excluding them from device ingestion.
    • Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. adapter now fetches agent identities as Application Resources.
    • Ninja One (RMM) adapter is now supported in the Agent Coverage Workspace, enabling agent coverage tracking, version monitoring, and pre-built detection rules.
    • Oracle Cloud adapter adds five new optional block storage endpoints: Boot Volumes, Volumes, Volume Backups, Boot Volume Backups, and Volume Group Backups.
    • Palo Alto Networks Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. adapter adds the option to fetch hardware information including Device Manufacturer, Model, RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed., and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. fields.
    • Ping Federate adapter adds an advanced setting to filter out machine-to-machine OAuth clients from SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. applications.
    • Proofpoint ObserveIT adapter adds a new Parse endpoint location IP address as public IP advanced setting (enabled by default).
    • Rapid7 Insight AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. adapter adds an optional Modules endpoint for Proof, Proof Description, and Module Name fields, and an optional Attacks endpoint for Attack Type and Attack Description fields on vulnerability variances.
    • Rubrik Security Cloud adapter adds enrichment options for Virtual Machine Edge devices and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Edge devices.
    • Sectigo adapter adds a configurable Page size advanced setting (default 100).
    • Sysdig - Secure adapter adds two new public API endpoints: Inventory Hosts and Runtime Results.
    • Tenable Vulnerability Management adapter adds an option to fetch cloud connectors (AWS, Azure, GCP) as Accounts.
    • Veeam adapter adds API version 1.7 support for Veeam Backup & Replication 13.
    • XM Cyber adapter adds a new Sensors endpoint that retrieves device data from the XM Cyber Sensors API.

    46 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Amazon Web Services (AWS) adapter: the Correlate EKS Containers with their EC2 Instance advanced setting has been removed; cloud identifiers are now applied automatically.
    • !Qualys Cloud Platform adapter: the Fetch software install paths (CSAM API) advanced setting has been removed; software install paths are now fetched inline from the Inventory API.
    • !Sectigo adapter: the default Page size changed from 200 to 100.
    • !OutThink adapter: a new required Customer ID connection field has been added; existing OutThink adapter connections must be updated to include it or they will break.
    • !Code42 Incydr adapter has been rebranded to Mimecast Incydr; any references to the adapter by its old name will need to be updated.
92. docs update Jul 21, 2026 · issue 021

    Axonius adds Cyber Physical Assets module for passive OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. device discovery, protocol-based enrichment, and network communication monitoring.

    • Passively discovers devices and vulnerabilities on the wire via new Cyber Physical Assets capability.
    • Queries OT devices for protocol-based enrichment of asset data.
    • Monitors network communications for operational technology environments.

    3 details in Everything

93. docs update Jul 21, 2026 · issue 021

    Axonius adds Cyber Physical Assets module for passive OT device discovery, protocol-based enrichment, and network communication monitoring.

    • Passively discovers devices and vulnerabilities on the wire for OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. environments via new Cyber Physical Assets capability.
    • Queries OT devices for protocol-based enrichment to surface detailed asset context.
    • Monitors network communications across cyber-physical environments.

    3 details in Everything

94. docs update Jul 21, 2026 · issue 021

    Axonius adds Cyber Physical Assets module for passive OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. device discovery, vulnerability detection, and network monitoring.

    • Passively discovers devices and vulnerabilities on the wire for OT/ICS environments.
    • Queries OT devices using protocol-based enrichment to gather richer asset context.
    • Monitors network communications for cyber-physical asset visibility.

    3 details in Everything

95. Axonius Release Notes 9.0.2 (2026-07-09) Jul 9, 2026 · issue 014

    Axonius 9.0.2 adds CISA Vulnrichment, Latest Snapshot View, Ingestion Rules set_value, 4 new adapters, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Visiting Data Scopes.

    └──▷ HOW TO FIND IT
    Run stable asset queries during an active discovery cycle without waiting for it to complete.
    📍In the Axonius console, open any asset table, click the View selector at the top, choose Latest Snapshot View, then run your query — results reflect the last completed discovery and remain stable while a new cycle is in progress.
    Dynamically normalize vendor name casing during adapter ingestion to keep asset data consistent across sources.
    📍In Axonius console, go to Ingestion Rules › create or edit a rule › add a Post-Action of type set_value, set the target field to vendor, choose the trim_prefix or regex_extract transformation, and save — the rule applies the transformation to every record ingested from the configured adapter.
    Prevent stale resolved CVEs from reappearing in the platform after a re-fetch.
    📍In the Axonius console, navigate to an adapter's Advanced Settings › Adapter Configuration, locate 'Ignore Security Findings fixed more than X days ago', set X to your desired retention window (e.g., 30), and save the connection.
    • Adds CISA Vulnrichment as an out-of-the-box vulnerability enrichment source, providing CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. mappings, affected product data, and SSVCSSVCA decision-support framework for vulnerability prioritization, maintained by CISA and Carnegie Mellon's CERT/CC, that uses stakeholder-specific decision trees to guide patch and remediation timing instead of relying on numeric scores alone. metrics.
    • New CVE Enrichment Settings section under System Settings > Enrichment consolidates control over 24 vulnerability enrichment sources with granular field selection.
    • Introduces Latest Snapshot View — a point-in-time, read-only view of asset data isolated from live discovery cycles, enabling faster and stable query results during active discovery.
    • Rebuilt data tables from the ground up, removing column limits, adding column pinning in Edit Columns, and replacing hover-based row actions with a three-dot menu.
    • Adds Markdown support to Dashboard Text Widgets, enabling formatted headings, bold text, and other markup directly in the widget editor.

    +22 more show less

    • Renames Findings to Monitoring across the platform, with updated navigation, page headers, table columns, filters, and rule-creation drawer.
    • New 'Ignore Security Findings fixed more than X days ago' setting on Adapter Configuration pages prevents stale CVE/Security Findings from being reintroduced.
    • Adds two new Adapter Connection notification triggers: alert when no fetch started in X days, and alert when no successful fetch completed in X days.
    • Ingestion Rules gain a new set_value post-action enabling dynamic field assignment during adapter data ingestion, supporting static literals, field-to-field copying, and built-in transformations (trim_prefix, trim_suffix, trim_regex, regex_extract).
    • New System Settings control for parallel task count during Network Routes enrichment, overriding automatic CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware.-based calculation.
    • SAML user assignment rules now support a Visiting Data Scopes field, enabling automatic data scope access for matched users at login.
    • Dashboard Chart Click-Through now opens the Asset Table using the view associated with the clicked chart segment, preserving context across chart types.
    • New adapter: Broadcom Layer7 API Gateway (fetches Users, Application Resources).
    • New adapter: Figma (fetches Users, Groups, Audit Activities).
    • New adapter: Palo Alto Networks Cortex Cloud (fetches Devices, Containers, Cloud Security Exposures, Compliance Findings).
    • New adapter: UKG Pro HCM Reports-as-a-Service (fetches Users via SOAP/Cognos).
    • BIND adapter adds TSIGTSIGA DNS authentication mechanism defined in RFC 2845 that uses shared secret keys and HMAC to sign DNS messages, letting resolvers and servers verify that updates or zone transfers come from a trusted peer. key authentication for DNS zone transfers (TSIG Key Name, TSIG Key Secret, TSIG Algorithm settings).
    • Cloudflare DNS adapter supports account-owned API tokens (cfat_ prefix) via a new optional Account ID connection setting.
    • CrowdStrike Falcon adapter adds Fetch Cases advanced setting to access the Cases API.
    • Cisco Firepower Management Center adapter adds ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. table data fetching and a new Firewall Name field on Firewall Rule assets.
    • BeyondTrust Privilege Management Cloud adapter adds blocked application event data fetch from the v2 Events API with configurable time range, page size, and event action filters.
    • A10 adapter adds fetching of load balancer configuration data including service groups, partitions, listeners, and endpoint details.
    • BitSight Security Ratings adapter adds observations data fetch, including vulnerabilities and company findings.
    • FortiSASE adapter now fetches Devices and Installed Software, with a new advanced setting to enable or disable software fetching.
    • Google Cloud Platform adapter adds fetching of Google App Engine instances as Compute Services assets.
    • Infoblox DDI adapter enriches IPAM statistics directly onto Network assets as new fields (Network, Conflict Count, Unmanaged Count, Utilization) instead of creating separate device assets.
    • Axonius documentation now exposes llm.txt and markdown views for AI consumption, reducing inference costs for AI-assisted workflows.

    27 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bitbucket Cloud V2 connections require workspace slugs to be added after upgrading, as the /user/workspaces endpoint has been deprecated and a new Workspace Slugs connection setting is now required.
    • !Com Laude domain records have been changed from the Devices asset type to Domains & URLs; existing queries that filter Devices by domain-related fields may need to be updated to query URLs instead.
    • !Infoblox DDI A Records (record:a) and Shared A Records (sharedrecord:a) are now parsed as Domains & URLs instead of Devices; any saved queries, Enforcement Actions, dashboards, reports, or workflows targeting these records as Devices will need to be updated to use Domains & URLs instead.
96. Axonius Release Notes 9.0.1 (2026-06-25) Jun 25, 2026 · issue 021

    Axonius 9.0.1 adds 5 new adapters, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. advanced role/scope mapping, custom compliance values, and dozens of adapter enhancements.

    └──▷ HOW TO FIND IT
    Assign roles from one SAML attribute (e.g., group membership) and data scopes from another (e.g., department) for fine-grained SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access control.
    📍In the console, go to Settings › Access Settings › SAML, enable Advanced Mapping, then configure the Role mapping table with your group-membership claim and the Data Scope mapping table with your department claim.
    Override Axonius default compliance benchmarks with your organization's own thresholds for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application settings.
    📍In the console, go to SaaS Applications › Settings, locate the setting to customize, and set a Custom Setting Recommended Value to define your compliance standard.
    Give all dashboard viewers a consistent default filter view without overriding individual saved preferences.
    📍In the console, open a Dashboard, click Saved Filters, hover over the target filter, click the 3-dot menu, and select Set as Default.
    • New Bold Security adapter: inventories endpoints, agent status, and browser extension protection.
    • New EasyDNS adapter: fetches domain registrations, zone management, and DNS record configurations.
    • New Google Threat Intelligence ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adapter: discovers internet-facing assets including domains, networks, network services, and aggregated security findings.
    • New Lenovo Device Orchestration adapter: fetches devices and users with AI-driven fleet health, hardware diagnostics, and warranty data.
    • New One Identity Safeguard adapter: fetches managed devices with privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. context including credential vaulting and session monitoring.

    +34 more show less

    • SAML Advanced Mapping now supports independent role and data scope assignment via separate mapping tables, each matched to a different SAML claim.
    • Users can define Custom Setting Recommended Values for SaaS application compliance, overriding Axonius defaults with organization-specific standards.
    • Dashboard Saved Filters: users with Edit Dashboard permissions can now set a saved filter as the system default for a dashboard.
    • Abnormal Security adapter now fetches SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. tokens as a new Secrets data source for inventorying API tokens.
    • Archer IRMIRMInsider Risk Management: a discipline focused on detecting and responding to threats from employees or contractors with legitimate access, giving cyber tools behavioral analytics and policy-enforcement hooks for internal actors. adapter adds support for fetching Application Settings (password policies, session timeouts, lockout policies) via a new Fetch Application Settings advanced setting.
    • Arnica.io adapter adds severity-level filtering for findings (critical, high, medium, low, info, unknown) to improve query performance.
    • Check Point Infinity adapter enriches firewall policies with associated threat profiles and mitigated CVEs when threat profile fetching is enabled.
    • Cisco Meraki adapter enables custom parsing support for devices.
    • Cisco Secure Access adapter is now available in the Agent Coverage Workspace for tracking agent deployments and coverage gaps.
    • Cisco Webex adapter now fetches Activities as a new asset type, with optional role information and OAuth authorization enrichment for users.
    • Cloudflare Zero Trust adapter now fetches tunnel connections as Network Services.
    • CrowdStrike Falcon adapter now fetches AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. Fargate assets as Serverless Functions.
    • CyberArk Endpoint Privilege Manager adapter adds support for Software assets and fetching installed programs.
    • CyberArk Idaptive adapter adds a new advanced setting to control whether device entities are fetched during discovery.
    • CyberArk Privileged Account Security adapter adds a Parse Device from User Account advanced setting to create devices from account address domain values.
    • Duo Beyond adapter now fetches application-level account settings including MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. requirements, password policies, and lockout thresholds.
    • Freshdesk adapter now fetches Tickets.
    • GitHub adapter adds options to fetch SSH keys as Secrets and repository last login per user.
    • Jamf Pro adapter adds an option to fetch device compliance information from Jamf's Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. API.
    • Jira Service Management adapter adds support for Groups and URLs entity types from Jira Insight.
    • Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. adapter adds the option to fetch printers as Devices.
    • Microsoft Defender for Endpoint adapter adds detailed vulnerability information fields (summary, impact, remediation) and changes the default for vulnerability aggregation to True.
    • NodeZero adapter adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. fields, network services data per pentest endpoint, and Active Directory password audit findings.
    • Observium adapter now fetches Network Devices.
    • Oracle Cloud adapter adds support for fetching Vaults, Vault Secrets, Keys, and Volume Backup Policies via the generic adapter engine.
    • Qualys Cloud Platform adapter adds a new advanced setting to fetch software install paths via the CSAM API.
    • Rapid7 Nexpose/InsightVM adapter replaces the boolean vulnerability rich text setting with granular per-field selection.
    • ServiceNow relationship settings consolidated into a dedicated Relationship enrichment configuration section with Disabled, Fetch always, and Use cached relationships modes.
    • Akamai Kona WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adapter adds an advanced setting to use the OS DNS resolver instead of Quad9 when parsing URL IP addresses.
    • Google Security Operations SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. adapter's Queries advanced setting now accepts a single delimited string with a configurable Delimiter setting.
    • CyberArk Privilege Cloud adapter adds a configurable Safes page size setting to prevent timeouts on large safe volumes.
    • New Relic adapter adds an option to enrich Windows Services onto parent HOST devices instead of creating separate device records.
    • Abion adapter adds a new endpoint to fetch domain-specific information including hosts and contacts data.
    • Custom Files adapter now fetches Application Settings.

    39 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !HPE Aruba Networking ClearPass Policy Manager: the Extended Info Fetch Window (Days) value is now constrained to 0–90; existing configurations with values outside this range must be updated.
    • !Microsoft Defender for Endpoint: the default value for vulnerability aggregation has changed to True, which may alter existing fetch behavior on upgrade.
97. Axonius Release Notes 9.0.1 (2026-06-25) Jun 25, 2026 · release notes

    Axonius 9.0.1 adds custom SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. compliance values, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. role/data scope mapping, and 6 new adapters.

    └──▷ HOW TO FIND IT
    Configure custom SaaS compliance standards by setting recommended values.
    📍In SaaS Applications settings, define Custom setting recommended value to override Axonius default recommendations.
    Map roles and data scopes independently in SAML configuration.
    📍Enable Advanced Mapping in Access Settings › SAML, then configure separate role assignment and data scope assignment tables matching different SAML claims.
    Fetch vault secrets and keys from Oracle Cloud using the generic adapter engine.
    📍In Oracle Cloud adapter Advanced Settings → Endpoints Config, enable Vaults, Vault Secret, Keys, and Volume Backup Policy (disabled by default).
    • Adds Custom setting recommended value for SaaS application settings to define organization-specific compliance standards.
    • Introduces independent mapping of roles and data scopes in SAML configurations via two separate tables in Advanced Mapping.
    • Adds six new adapters: Bold Security, EasyDNS, Google Threat Intelligence ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them., Industrial Defender ASM, Lenovo Device Orchestration, One Identity Safeguard.
    • Updates Airlock Digital adapter to fetch Agent Versions field for devices.
    • Enables AWS adapter to set Fetch Organization Accounts as assets (renamed from Fetch Organizations as assets).

    +26 more show less

    • Enables Archer IRMIRMInsider Risk Management: a discipline focused on detecting and responding to threats from employees or contractors with legitimate access, giving cyber tools behavioral analytics and policy-enforcement hooks for internal actors. adapter to fetch Application Settings via new Fetch Application Settings advanced setting.
    • Adds Arnica.io advanced setting to filter findings by severity level (critical, high, medium, low, info, unknown).
    • Enables Cisco Secure Access adapter in the Agent Coverage Workspace for monitoring agent deployments and coverage gaps.
    • Updates Cisco Webex adapter to fetch Activities, role information, and OAuth authorizations via new advanced settings.
    • Allows Cloudflare Zero Trust adapter to fetch tunnel connections as Network Services.
    • Adds AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. Fargate assets as Serverless Functions in CrowdStrike Falcon adapter with restructured POD asset configuration.
    • Enables Custom Files adapter to fetch Application Settings.
    • Adds CyberArk Endpoint Privilege Manager support for Software assets and installed programs via advanced setting.
    • Introduces advanced setting in CyberArk Idaptive adapter to control device entity fetching during discovery.
    • Adds configurable Safes page size setting in CyberArk Privilege Cloud adapter to prevent timeouts.
    • Enables CyberArk Privileged Account Security adapter to parse devices from user account domain values via Parse Device from User Account advanced setting.
    • Updates Duo Beyond adapter to fetch account settings including password policies, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. requirements, and lockout thresholds.
    • Adds GitHub option to fetch and store SSH keys as Secrets in Axonius.
    • Enables Google Security Operations SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. adapter to use Delimiter advanced setting for UDM queries (replacing list format with delimited string).
    • Updates HPE Aruba Networking ClearPass Policy Manager adapter with new constraints for Extended Info Fetch Window (Days) (0-90 days) and async fallback options.
    • Adds Jamf Pro option to fetch device compliance information from Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. API.
    • Enables Jira Service Management adapter to support Custom Parsing for Firewalls and Groups/URLs entity types from Insight.
    • Allows Microsoft AD adapter to fetch printers as Devices.
    • Updates Microsoft Defender for Endpoint adapter with detailed vulnerability info in records and changed default for vulnerability aggregation to True.
    • Enhances New Relic adapter to enrich Windows Services onto parent HOST devices.
    • Adds NodeZero support for MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet., UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., network services, and Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. password audit findings.
    • Updates Observium adapter to fetch Network Devices.
    • Updates Oracle Cloud adapter to fetch Vaults, Vault Secrets, Keys, and Volume Backup Policy via generic adapter engine (disabled by default).
    • Enhances Proofpoint Endpoint DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. adapter to automatically extract directory fields from API responses.
    • Adds Qualys Cloud Platform advanced setting to fetch software install paths via CSAM API.
    • Replaces boolean Parse Proof and Key Rich Text Fields for vulnerabilities in Rapid7 adapters with granular configuration for selecting specific fields.

    31 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The AWS adapter setting Fetch Organizations as assets is renamed to Fetch Organization Accounts as assets.
    • !HPE Aruba Networking ClearPass Policy Manager requires Extended Info Fetch Window (Days) values to be between 0 and 90; existing configurations outside this range will fail or need updating.
98. Axonius Release Notes 9.0 (2026-05-27) May 27, 2026 · release notes

    Axonius 9.0 introduces Business Context classification, Security Finding Rules, Asset Criticality, and a new navigation structure.

    └──▷ HOW TO FIND IT
    Visualize classification coverage and identify gaps in Business Context rules.
    📍Enable the New navigation toggle at the top of your screen, then navigate to Inventory › Business Context.
    Create independent Security Finding Rules for non-CVE threats and view them in a dedicated tab.
    📍In the Exposures module, create new Security Finding Rules using queries, then view assets under the Axonius Security Findings tab on the Security Findings page.
    Track unused licenses by comparing seat counts against actual device usage.
    📍View the Device Unique Users Count and Inactive License Users Count fields in the Software Management module or on the Devices page.
    • Adds Business Context feature for centralized asset classification by business unit, lifecycle status, and ownership
    • Adds three-tab view (All, Axonius Security Findings, External Security Findings) to the Security Findings page
    • Enriches vulnerability data with Axonius Threat Intelligence including exploit, weaponization, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. status
    • Introduces Axonius Vulnerability Score (AVS) calculated via an AI-powered pipeline for risk prioritization
    • Adds Asset Criticality mechanism with pre-defined rules and custom query-based categories for assets

    +8 more show less

    • Provides out-of-the-box Security Finding Risk Score and Asset Risk Score models for prioritization
    • Empowers analysts to assign remediation tasks via the new Remediation Ownership feature
    • Generates prioritized solution lists in Recommended Actions tab within the Action Center
    • Adds Internal Software Version Rank field to rank installed software versions by recency
    • Adds Device Unique Users Count and Inactive License Users Count fields for license tracking
    • Redesigns platform navigation into Home, Dashboard, Inventory, Exposures, Action Center, Adapters, and Analysis sections
    • Enables adding relationship columns from related asset tables in the Query Wizard
    • Allows setting maximum timeout (up to 6 hours) for Network Routes enrichment process

    13 details in Everything

99. Axonius Release Notes 8.0.25 (2026-05-27) May 27, 2026 · release notes

    Axonius 8.0.25 adds incremental workflow testing, new adapters (A10, Netgate pfSense, etc.), and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. compliance standards.

    └──▷ HOW TO FIND IT
    Test workflow logic node-by-node to catch configuration errors early without affecting production assets.
    📍Run the Workflow Test Run & Debugging feature in the Axonius platform interface, selecting specific nodes or the entire workflow to validate data flow and execution status.
    Enable AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. authentication for Akeyless Vault adapters to eliminate static credential rotation.
    📍Configure the Akeyless Vault adapter in Axonius System Settings, selecting AWS IAM and Universal Identity authentication methods to utilize role-based authentication via EC2 instance profiles.
    Fetch firewall threat profiles to enrich network traffic security visibility in Palo Alto Networks Panorama.
    text copy

    Enable the 'Fetch Firewall Threat Profiles' advanced setting in the Palo Alto Networks Panorama adapter configuration within Axonius.

    • Adds node-by-node Workflow Test Run & Debugging to build and test workflows incrementally without production risk
    • Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 standard support in the Compliance field on the SaaS Applications page
    • Sets Create New Asset fields as default fields on Assets Pages
    • Adds Akeyless Vault adapter support for AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. and Universal Identity authentication methods
    • Adds new adapter for A10 Control to fetch Devices

    +35 more show less

    • Adds new adapter for Beamy to fetch SaaS Applications
    • Adds new adapter for Boost Security to fetch Application Resources
    • Adds new adapter for FortiAuthenticator to fetch Users, Devices, Groups
    • Adds new adapter for GEM One to fetch Devices
    • Adds new adapter for Netgate pfSense to fetch Networks and Network/Firewall Rules
    • Adds new support for fetching allowed devices from AlgoSec Firewall Analyzer with device type filtering
    • Adds GitHub Advanced Security vulnerability alerts as Security Findings in Azure DevOps adapter
    • Adds option to fetch devices during active BigFix Inventory import
    • Enhances BitSight Security Ratings to parse domain and URL findings as separate asset types
    • Adds benchmark exceptions and rule-level errors per assessment in CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.-CAT Pro adapter
    • Adds hostname exclusion advanced setting in Cisco Meraki adapter
    • Migrates CloudFlare Zero Trust adapter to API Token-only authentication, removing User Email connection parameter
    • Adds Network Services fetching for Cloudflare DNS adapter with parsing of MX, TXT, SRVSRVA DNS record type that advertises the hostname and port for a specific service, letting clients discover endpoints without hardcoded addresses., NS, PTR records
    • Adds option to fetch only online devices in CrowdStrike Falcon adapter
    • Migrates CyberArk Endpoint Privilege Manager to POST /Sets/{set_id}/Endpoints/search endpoint
    • Adds Application Settings and SaaS Applications fetching options in Databricks adapter
    • Adds device log enrichment option in Exabeam Cloud adapter
    • Adds DNS lookup disabling option for virtual servers in F5 BIG-IP iControl adapter
    • Adds network assets fetching from global interfaces in FortiManager adapter
    • Adds Application Settings fetching in Google Workspace adapter
    • Adds support for API v3 in Greenhouse adapter alongside existing API v1
    • Adds devices fetching and card reader enrichment in Lenel OnGuard adapter
    • Fetches Azure AI services as Application Services in Microsoft Azure adapter
    • Adds vulnerability severity filtering option in Microsoft Defender for Endpoint adapter
    • Adds Cloud Environment configuration option for Azure US Government Cloud in Microsoft Teams enforcement actions
    • Adds Application Settings fetching in MicroStrategy adapter
    • Disables Enrich Users with Messages From endpoint by default in Mimecast V2 adapter
    • Fetches networks and network site information in NetBrain adapter
    • Adds Use API v4 advanced setting for Nutanix Prism Central adapter
    • Updates Okta adapter connection test to support connections without okta.users.read permission
    • Adds activities fetching via OpenAI Compliance API in OpenAI adapter
    • Adds mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. authentication, configurable OAuth scope, and page size configuration in Oracle Fusion HCM Cloud adapter
    • Adds Fetch Firewall Threat Profiles advanced setting in Palo Alto Networks Panorama adapter
    • Adds extension type filtering option for device endpoint queries in Ring Central adapter
    • Merges Table Mapping component in ServiceNow adapter to remove workflow complexity

    40 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CloudFlare Zero Trust adapter removes User Email connection parameter; existing connections must switch to API Token-only authentication
    • !Mimecast V2 adapter changes Enrich Users with Messages From endpoint to disabled by default; users must manually enable it in advanced settings