Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Faqs Account Billing2 - AskJ1 Community
<main> <article class="userContent"> <table><thead><tr><th>Entity</th> <th>Description</th> <th>Billable</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">AccessKey</code></td> <td>A key used to grant access, such as ssh-key, access-key, api-key/token, <br>mfa-token/device, etc.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> <td>A policy for access control assigned to a Host, Role, User, UserGroup, or Service.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">AccessRole</code></td> <td>An access control role mapped to a Principal (e.g. user, group, or service).</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code>Entity</td> <td>An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service.Description</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Application</code></td> <td>A software product or application.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">ApplicationEndpoint</code></td> <td>An application endpoint is a program interface that either initiates or receives a request, such as an API.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Assessment</code></td> <td>An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Attacker</code></td> <td>An attacker or threat actor.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Backup</code></td> <td>A specific repository or data store containing backup data.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Certificate</code></td> <td>A digital Certificate such as an SSL or S/MIME certificate.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Channel</code></td> <td>A communication channel, such as a Slack channel or AWS SNS topic.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> <td>A cluster of compute or database resources/workloads.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">CodeCommit</code></td> <td>A code commit to a repo. The commit id is captured in the _id property of the Entity.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">CodeDeploy</code></td> <td>A code deploy job.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">CodeModule</code></td> <td>A software module. Such as an npm_module or java_library.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">CodeRepo</code></td> <td>A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">CodeReview</code></td> <td>A code review record.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> <td>A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task_definition</code> is a <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code>.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Container</code></td> <td>A standard unit of software that packages up code and all its dependencies and configurations.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Control</code></td> <td>A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">ControlPolicy</code></td> <td>An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">CryptoKey</code></td> <td>A key used to perform cryptographic functions, such as an encryption key.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">DataObject</code></td> <td>An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the _type property of the Entity.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code></td> <td>A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the _type property of the Entity.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Database</code></td> <td>A database cluster/instance.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Deployment</code></td> <td>A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Device</code></td> <td>A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the _type property of the Entity.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Directory</code></td> <td>Directory, such as LDAP or Active Directory.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Disk</code></td> <td>A disk storage device such as an AWS EBS volume</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Document</code></td> <td>A document or data object.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Domain</code></td> <td>An internet domain.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">DomainRecord</code></td> <td>The DNS Record of a Domain Zone.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">DomainZone</code></td> <td>The DNS Zone of an Internet Domain.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> <td>A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The <code class="code codeInline" spellcheck="false" tabindex="0">IMPACTS</code> relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The <code class="code codeInline" spellcheck="false" tabindex="0">IMPACTS</code> relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Firewall</code></td> <td>A piece of hardware or software that protects a network/host/application.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Framework</code></td> <td>An object to represent a standard compliance or technical security framework.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Function</code></td> <td>A virtual application function. For example, an aws_lambda_function, azure_function, or google_cloud_function</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> <td>A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Group</code></td> <td>A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Host</code></td> <td>A compute instance that itself owns a whole network stack and serves as an environment for workloads. Typically it runs an operating system. The exact host type is described in the _type property of the Entity. The UUID of the host should be captured in the _id property of the Entity</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">HostAgent</code></td> <td>A software agent or sensor that runs on a host/endpoint.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Image</code></td> <td>A system image. For example, an AWS AMI (Amazon Machine Image).</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Incident</code></td> <td>An operational or security incident.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Internet</code></td> <td>The Internet node in the graph. There should be only one Internet node.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">IpAddress</code></td> <td>An re-assignable IpAddress resource entity. Do not create an entity for an IP Address <em>configured</em> on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Key</code></td> <td>An ssh-key, access-key, api-key/token, pgp-key, etc.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Logs</code></td> <td>A specific repository or destination containing application, network, or system logs.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Module</code></td> <td>A software or hardware module. Such as an npm_module or java_library.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Network</code></td> <td>A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">NetworkEndpoint</code></td> <td>A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">NetworkInterface</code></td> <td>An re-assignable software defined network interface resource entity. Do not create an entity for a network interface <em>configured</em> on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Organization</code></td> <td>An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">PR</code></td> <td>A pull request.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">PasswordPolicy</code></td> <td>A password policy is a specific <code class="code codeInline" spellcheck="false" tabindex="0">Ruleset</code>. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Person</code></td> <td>An entity that represents an actual person, such as an employee of an organization.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Policy</code></td> <td>A written policy documentation.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Procedure</code></td> <td>A written procedure and control documentation. A Procedure typically <code class="code codeInline" spellcheck="false" tabindex="0">IMPLEMENTS</code> a parent Policy. An actual Control further <code class="code codeInline" spellcheck="false" tabindex="0">IMPLEMENTS</code> a Procedure.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Process</code></td> <td>A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure).</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Product</code></td> <td>A product developed by the organization, such as a software product.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Program</code></td> <td>A program. For example, a bug bounty/vuln disclosure program.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Project</code></td> <td>A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Queue</code></td> <td>A scheduling queue of computing processes or devices.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Record</code></td> <td>A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the _type property of the Entity.</td> <td>No</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Repository</code></td> <td>A repository that contains resources. For example, a Docker container registry repository hosting Docker container images.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Requirement</code></td> <td>An individual requirement for security, compliance, regulation or design.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Resource</code></td> <td>A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Review</code></td> <td>A review record.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Risk</code></td> <td>An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a <code class="code codeInline" spellcheck="false" tabindex="0">MITIGATES</code> relationship to a Risk.</td> <td>Ye</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Root</code></td> <td>The root node in the graph. There should be only one Root node per organization account.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Rule</code></td> <td>An operational or configuration compliance rule, often part of a Ruleset.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Ruleset</code></td> <td>An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Scanner</code></td> <td>A system vulnerability, application code or network infrastructure scanner.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Section</code></td> <td>An object to represent a section such as a compliance section.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> <td>A service provided by a vendor.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Site</code></td> <td>The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located_at or work_at). Also used as the abstract reference to AWS Regions.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Standard</code></td> <td>An object to represent a standard such as a compliance or technical standard.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Subscription</code></td> <td>A subscription to a service or channel.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Task</code></td> <td>A computational task. Examples include AWS Batch Job, ECS Task, etc.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Team</code></td> <td>A team consists of multiple member Person entities. For example, the Development team or the Security team.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">ThreatIntel</code></td> <td>Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Training</code></td> <td>A training module, such as a security awareness training or secure development training.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> <td>A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">UserGroup</code></td> <td>A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Vault</code></td> <td>A collection of secrets such as a key ring</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Vendor</code></td> <td>An external organization that is a vendor or service provider.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Vulnerability</code></td> <td>A security vulnerability (application or system or infrastructure). A single vulnerability may relate to multiple findings and impact multiple resources. The <code class="code codeInline" spellcheck="false" tabindex="0">IMPACTS</code> relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The <code class="code codeInline" spellcheck="false" tabindex="0">IMPACTS</code> relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Weakness</code></td> <td>A security weakness.</td> <td>Yes</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Workload</code></td> <td>A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the _type property of the Entity.</td> <td>Yes</td> </tr><tr><td>[System Mapped Entities]</td> <td>Entities with <code class="code codeInline" spellcheck="false" tabindex="0">_source='system-mapper'</code></td> <td>No</td> </tr><tr><td>[System Internal Entities]</td> <td>Entities with <code class="code codeInline" spellcheck="false" tabindex="0">_source='system-internal'</code></td> <td>No</td> </tr><tr><td>[Custom Created Entities]</td> <td>Entities created with a custom-defined _class or _type</td> <td>Yes</td> </tr></tbody></table> </article> </main>
.png)