System data mapping

This page describes how data retrieved from the source service is mapped into records generated by the connector.

For each record type, the following information is reported:

• the property name exposed by the connector;
• the path from which the value is obtained in the source service;
• any additional note regarding transformations, enrichments or special behaviours.

Each record mapping section is titled {Source Object Name} ({_type}), combining the object name used by the source service with the internal record type produced by the connector.

Common properties

Property name	Source path	Notes
_type		Record type: sitegroup, site, device or networkinterface

Notes

• Dates are normalized to the ISO 8601 format.
• Properties marked "joined with ," are lists of the source object converted to a single string, with the elements separated by a comma.

Site group (sitegroup)

A group of sites, as returned by the site-groups/get API.

Property name	Source path	Notes
id	id
name	name
note	note
number_of_sites	number_of_sites	When number_of_sites is empty, the number of elements of sites is used

Site (site)

A site (physical location) in which Claroty discovers the devices, as returned by the sites/get API.

Property name	Source path	Notes
id	id
name	name	Used to identify the site in the relations from devices
location	location
timezone	timezone
country_code	country_code
description	description
devices_count	devices_count
site_group	site_group_id	Record Id of the related sitegroup

Device (device)

A device (OT, IoT or IT asset) discovered by Claroty, as returned by the devices API.

Property name	Source path	Notes
id	asset_id
name	device_name
category	device_category
subcategory	device_subcategory
uid	uid
detector_name	detector_name
type_family	device_type_family
type	device_type
model	model
model_family	model_family
serial_number	serial_number
retired	retired
retired_since	retired_since	ISO date
labels	labels	Joined with ,
assignees	assignees	Joined with ,
hw_version	hw_version
local_name	local_name
os_name	os_name
os_version	os_version
os_revision	os_revision
os_patch_level	os_patch_level
os_category	os_category
os_subcategory	os_subcategory
os_eol_date	os_eol_date	ISO date
combined_os	combined_os
management_services	management_services	Joined with ,
last_domain_user	last_domain_user
last_domain_user_activity	last_domain_user_activity	ISO date
mobility	mobility
criticality	criticality
purdue_level	purdue_level
purdue_level_source	purdue_level_source
windows_hostname	windows_last_seen_hostname
dhcp_hostname	dhcp_last_seen_hostname
http_hostname	http_last_seen_hostname
snmp_hostname	snmp_last_seen_hostname
other_hostnames	other_hostnames	Joined with ,
note	note
domains	domains	Joined with ,
internet_communication	internet_communication
machine_type	machine_type
number_of_nics	number_of_nics
is_online	is_online
manufacturer	manufacturer
product_code	product_code
financial_cost	financial_cost
end_of_life_state	end_of_life_state
end_of_sale_date	end_of_sale_date
end_of_life_date	end_of_life_date
risk_score	risk_score
software_or_firmware_version	software_or_firmware_version
utilization_rate	utilization_rate
activity_rate	activity_rate
site	site_name	Record Id of the related site, matched by site name (case insensitive)

Network interface (networkinterface)

Calculated record: Claroty does not expose network interfaces as separate objects, but returns their data inside each device as parallel lists (the *_list fields), where the elements with the same index refer to the same interface. The connector generates one record for each index from 0 to number_of_nics - 1 of each device.

Property name	Source path	Notes
code	mac_list, ip_list	MAC address and IP address of the interface joined with - (empty values are skipped)
asset_id	asset_id	Asset id of the device
mac_address	mac_list
mac_oui_vendor	mac_oui_list
ip_address	ip_list
ip_assignment	ip_assignment_list
network_type	network_list
network_scope	network_scope_list
connection_type	connection_type_list
wireless_network_name	ssid_list
access_point_name	ap_name_list
access_point_mac	bssid_list
access_point_location	ap_location_list
access_point_last_seen	wifi_last_seen_list	ISO date
switch_name	switch_name_list
switch_location	switch_location_list
switch_mac	switch_mac_list
switch_ip	switch_ip_list
switch_port	switch_port_list
switch_port_description	switch_port_description_list
switch_last_seen	last_seen_on_switch_list	ISO date
vlan_id	vlan_list	Converted to string
vlan_name	vlan_name_list
vlan_description	vlan_description_list
vlan_qualifier	vlan_qualifier_list
first_seen	first_seen_list	ISO date
last_seen	last_seen_list	ISO date
device	asset_id	Record Id of the related device

Notes

• Each list field contributes the element at the index of the interface; when a list is missing or shorter, the property is empty.
• No interface is generated for devices without asset_id or number_of_nics, and for the indexes where both the MAC address and the IP address are empty.