Axonius V2
LAST UPDATED: OCTOBER 20, 2025
Overview
The Axonius Platform serves as the system of record for all digital infrastructure, enabling IT and security teams to gain a complete understanding of assets, their relationships, and business context. The D3–Axonius integration enhances this capability by allowing seamless discovery of devices, users, and other critical assets.
D3 SOAR is providing REST operations to function with Axonius V2.
Axonius V2 is available for use in:
Connection
To connect to Axonius V2 from D3 SOAR, follow this part to collect the required information below:
Parameter | Description | Example |
Server URL | The URL of the Axonius instance. | https://daily-product.in.axonius.com |
API Key | The API key for the service account. | ***** |
API Secret | The API Secret for the service account. | ***** |
API Version | The version of the API to use for the connection. | v2 |
Configuring Axonius V2 to Work with D3 SOAR
Enabling API Access
Log into Axonius as a user with administrator access..
Navigate to
(Settings) > System Settings > Manage Roles.Click the desired role, select the API access enabled checkbox under the API Access category, then save.
Retrieving the API Key
Log into Axonius using an account with API access enabled.
This account is the one intended for use to connect with D3.
Click the account avatar, then select the User Settings option.
Navigate to the API Key tab, then copy the API key and secret. Refer to sub-steps 2 and 3 under step 3i in Configuring D3 SOAR to Work with Axonius V2.
Configuring D3 SOAR to Work with Axonius V2
Log in to D3 SOAR.
Find the Axonius V2 integration.
Navigate to Configuration on the top header menu.
Click on the Integration icon on the left sidebar.
Type Axonius V2 in the search box to find the integration, then click it to select it.
Click on the + Connection button on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Axonius V2.
Connection Name: The desired name for the connection.
Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
Description (Optional): The description for the connection.
Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
Configure User Permissions: Defines which users have access to the connection.
Active: The checkbox that enables the connection to be used when selected.
System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
1. Input the Server URL.
2. Copy the API Key from the Axonius V2 platform. Refer to step 3 of Retrieving the API Key.
3. Copy the API Secret from the Axonius V2 platform. Refer to step 3 of Retrieving the API Key.
4. Input the API Version. The default value is v2.
Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
Test the connection.
Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
Click OK to close the alert window.
Click + Add to create and add the configured connection.
Commands
Axonius V2 includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.
Integration API Note
For more information about the Axonius V2 API, refer to the Axonius V2 API reference. Users must log in with an administrator account when prompted to access the API reference.
Note for Time-related parameters
The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:
Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose the desired date and time format, then click on the Save button.
The selected time format will now be visible when configuring Date/Time command input parameters.
Get Device by ID
Retrieves device details by IDs.
READER NOTE
Internal Axon IDs is a required parameter to run this command.
Run the Search Endpoints command to obtain the Internal Axon IDs. Internal Axon IDs can be found in the raw data at $.assets[*].internal_axon_id.
Input
Input Parameter | Required/Optional | Description | Example |
Internal Axon IDs | Required | The IDs of internal Axon records for which to retrieve device details. Internal Axon IDs can be obtained using the Search Endpoints command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Get Device by ID failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Axonius V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Unauthorized. |
Error Sample Data Get Device by ID failed. Status Code: 401. Message: Unauthorized. |
Get Enforcement by ID
Retrieves details for enforcement sets by IDs.
READER NOTE
Enforcement IDs is a required parameter to run this command.
Run the Search Enforcements command to obtain the Enforcement IDs. Enforcement IDs can be found in the raw data at $.enforcements[*].uuid.
Input
Input Parameter | Required/Optional | Description | Example |
Enforcement IDs | Required | The IDs of enforcement sets for which to retrieve details. Enforcement IDs can be obtained using the Search Enforcements command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Get Enforcement by ID failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Axonius V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Unauthorized. |
Error Sample Data Get Enforcement by ID failed. Status Code: 401. Message: Unauthorized. |
Run Enforcements
Runs enforcement sets by IDs.
READER NOTE
Enforcement IDs is a required parameter to run this command.
Run the Search Enforcements command to obtain the Enforcement IDs. Enforcement IDs can be found in the raw data at $.enforcements[*].uuid.
Input
Input Parameter | Required/Optional | Description | Example |
Enforcement IDs | Required | The IDs of enforcement sets to run. Enforcement IDs can be obtained using the Search Enforcements command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Run Enforcements failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Axonius V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Unauthorized. |
Error Sample Data Run Enforcements failed. Status Code: 401. Message: Unauthorized. |
Search Endpoints
Retrieves a list of endpoints that match the provided criteria.
Input
Input Parameter | Required/Optional | Description | Example |
IP Addresses | Optional | Filters endpoint details by the specified IP addresses. |
JSON
|
Hostnames | Optional | Filters endpoint details by the specified hostnames. |
CODE
|
MAC Addresses | Optional | Filters endpoint details by the specified MAC addresses. |
JSON
|
Query | Optional | Filters endpoint details using an AQL query. Refer to Creating Queries with the Query Wizard for details. | ("specific_data.data.os.type" == "Windows") |
Limit | Optional | The number of endpoints to return up to a maximum of 2000. By default, the value is 1000. | 10 |
Offset | Optional | The number of endpoints to skip from the beginning of the result set. By default, the value is 0. | 1000 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Search Endpoints failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Axonius V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Unauthorized. |
Error Sample Data Search Endpoints failed. Status Code: 401. Message: Unauthorized. |
Search Enforcements
Retrieves details for enforcement sets.
Input
Input Parameter | Required/Optional | Description | Example |
Start Time | Optional | The start of the date range to search for enforcements (YYYY-MM-DD). This field is required if End Time is provided. | 2025-07-26 |
End Time | Optional | The end of the date range to search for enforcements (YYYY-MM-DD). This field is required if Start Time is provided. | 2025-08-26 |
Category | Optional | Filters enforcements by the specified category. | Notify |
Asset Type | Optional | Filters enforcements by the specified asset type. | Devices |
Names | Optional | Filters enforcements by the specified enforcement set names. |
JSON
|
Search | Optional | Filters enforcements by the provided search string. | test |
Limit | Optional | The number of enforcements to return. By default, the value is 1000. | 10 |
Offset | Optional | The number of enforcements to skip from the beginning of the result set. By default, the value is 0. | 1000 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Search Enforcements failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Axonius V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Unauthorized. |
Error Sample Data Search Enforcements failed. Status Code: 401. Message: Unauthorized. |
Search Users
Retrieves a list of users that match the provided criteria.
Input
Input Parameter | Required/Optional | Description | Example |
Username | Optional | Filters user details by the specified username. | john_doe |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Search Users failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Axonius V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Unauthorized. |
Error Sample Data Search Users failed. Status Code: 401. Message: Unauthorized. |
Test Connection
Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.
Input
N/A
Output
Output Type | Description | Return Data Type |
Return Data | Indicates one of the possible command execution states: Successful or Failed. The Failed state can be triggered by any of the following errors:
More details about an error can be viewed in the Error tab. | String |
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Test Connection failed. Failed to check the connector. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Axonius V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Unauthorized. |
Error Sample Data Test Connection failed. Failed to check the connector. Status Code: 401. Message: Unauthorized. |