Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne Entity Ingestion Sources - AskJ1 Community
<main> <article class="userContent"> <p>JupiterOne has a standard set of labels that represent how any single entity is ingested into the JupiterOne graph. You can find this information on entities on the <code class="code codeInline" spellcheck="false" tabindex="0">Metadata</code> tab in the entity drawer in J1 Assets. You can also filter against this information when you are querying JupiterOne by including the <code class="code codeInline" spellcheck="false" tabindex="0">_source</code> property in a <code class="code codeInline" spellcheck="false" tabindex="0">WITH</code> clause of a JupiterOne query.</p> <p>For example:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Which of my aws instances that were ingested by an integration use a data store? FIND aws_instance WITH _source = 'integration-managed' THAT USES DataStore RETURN TREE </pre> <h2 data-id="labels-of-ingestion-sources">Labels of Ingestion Sources</h2> <p><code class="code codeInline" spellcheck="false" tabindex="0">system-internal</code> - Entities that are created by an internal JupiterOne system that represents metadata about your JupiterOne instance. For example, users who have access to the JupiterOne software itself, compliance benchmarks, and alerts should have a <code class="code codeInline" spellcheck="false" tabindex="0">_source</code> value of <code class="code codeInline" spellcheck="false" tabindex="0">system-internal</code>.</p> <p><code class="code codeInline" spellcheck="false" tabindex="0">integration-managed</code> - Entities that are created by integrations. For example, if you configure an AWS integration and that integration ingests information into the J1 Graph, the source of those entities should have a <code class="code codeInline" spellcheck="false" tabindex="0">_source</code> value of <code class="code codeInline" spellcheck="false" tabindex="0">integration-managed</code>.</p> <p><code class="code codeInline" spellcheck="false" tabindex="0">system-mapper</code> - Entities that represent assets that have not been ingested into the J1 Graph by an integration but are determined to exist another way. In the JupiterOne data model, specific entity relationships can be inferred based on the correlation data certain entities have with one other. For example, you can expect that an entity that represents a <code class="code codeInline" spellcheck="false" tabindex="0">HostAgent</code> (such as scanning agents from vendors like CrowdStrike or SentinelOne) must also be accompanied by a <code class="code codeInline" spellcheck="false" tabindex="0">Host</code> that it is scanning (such as instances from a cloud service provider or a physical device that an employee uses to perform their work). In this case, the <code class="code codeInline" spellcheck="false" tabindex="0">Host</code> entity may be created by the system mapper if it does not already exist from an integration.</p> <p>Another example of a <code class="code codeInline" spellcheck="false" tabindex="0">system-mapper</code> entity results from the timing of how integrations might execute or the information JupiterOne can retrieve from vendor solutions. JupiterOne uses an entity with a <code class="code codeInline" spellcheck="false" tabindex="0">_source</code> value of <code class="code codeInline" spellcheck="false" tabindex="0">system-mapper</code> to represent an asset that likely exists (based on relationship data) before other integration sources have had the opportunity to hydrate or enrich it in the J1 Graph.</p> <p><code class="code codeInline" spellcheck="false" tabindex="0">api</code> - Entities that are created using the JupiterOne APIs are given a <code class="code codeInline" spellcheck="false" tabindex="0">_source</code> value of <code class="code codeInline" spellcheck="false" tabindex="0">api</code>.</p> <p><code class="code codeInline" spellcheck="false" tabindex="0">sample-data</code> - Entities that are created using the sample data feature of JupiterOne are given a <code class="code codeInline" spellcheck="false" tabindex="0">_source</code> value of <code class="code codeInline" spellcheck="false" tabindex="0">sample-data</code>.</p> </article> </main>
.png)