--- title: Palo Alto Xpanse - Expander V2 Connector Guide slug: rbvm-help/palo-alto-xpanse-expander-v2-connector-guide createdAt: 2026-10-26T13:51:23.443Z --- **Summary**: How to set up and use the Palo Alto Xpanse - Expander V2 connector in Ivanti Neurons RBVM/ASPM/VULN KB. ## Overview Palo Alto Xpanse - Expander V2 collects data about every device connected to the Internet and attributes assets to customers. Expander maintains the inventory associated with a given organization and sends alerts to unexpected, unknown, or risky IT assets that appear in the system. The Ivanti Neurons RBVM/ASPM/VULN KB platform provides an API-based connector that integrates with Palo Alto Expanse - Expander V2, enabling customers to bring in their findings. It allows customers to gain visibility into their overall risk due to vulnerabilities in their endpoint and a more straightforward, more efficient way to manage those vulnerabilities. ## User Prerequisites / Expander Setup Expander is a cloud-based solution. Ivanti Neurons requires a user account with the following access to communicate with and pull data from Expander. - Read access to the assets and their associated issues. - API access. ## Expander V2 Connector API Calls The following API calls are performed during a connector run to pull security vulnerabilities from Expander V2 into Ivanti Neurons for RBVM. | **API Type** | **Endpoint** | | ----------------------------------------------------- | -------------------------------------------------------------------------- | | Authentication | https\://expander.expanse.co/api/v1/idToken/ | | Fetch list of all assets or a filtered list of assets | https\://expander.expanse.co/api/v1/assets/get\_assets\_internet\_exposure | | Fetch a list of services | https\://expander.expanse.co/api/v1/assets/get\_external\_services/ | ## Platform Setup Navigate to the **Automate > Integrations** page. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations-1" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"} Using the search bar in the upper-right corner of the *Integrations* page, type **Expander** to find the connector. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/S5aRwWD5VXyZM3bxfwcKp_palo-alto-xpanse-v2-expander1.png" alt="Xpanse Expander - Search for Connector" position="flex-start" size="98" width="687" height="408" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse v2 Expander_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse v2 Expander_1.png" showCaption="false"} Locate the *Palo Alto Xpanse - Expander V2* card on the page and click **Configuration**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/D1Iph_iLI_adSkPpvjTVE_palo-alto-xpanse-v2-expander2.png" alt="Xpanse Expander - Search for Connector" position="flex-start" size="63" width="439" height="477" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse v2 Expander_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse v2 Expander_2.png" showCaption="false"} In the new window under *Connection*, complete the required fields, as described below. - **Name**: The connector’s name. - **URL**: The URL to access the Expander API (https\://expander.expanse.co). - **Client Id**: Expanse provides the Client Id; follow the documentation for steps to [Generate Client Credentials](https://docs.paloaltonetworks.com/cortex/cortex-xpanse/cortex-xpanse-user-guide/apis-and-integrations-main/expander-apis-and-integrations/expander-apis/generate-client-credentials.html). - **Client Secret**: Expanse provides the Client Secret; follow the documentation for steps to [Generate Client Credentials](https://docs.paloaltonetworks.com/cortex/cortex-xpanse/cortex-xpanse-user-guide/apis-and-integrations-main/expander-apis-and-integrations/expander-apis/generate-client-credentials.html). - **Network**: This connector is available** only when using a** **Mixed network**. For more information, see [Networks: Overview](docId\:j5M2DcyZh-gOn7LRVxTEz). ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/9tr4ruBJG-4kroRU2nD_D_palo-alto-xpanse-v2-expander3.png" alt="Palo Alto Xpanse - Connection Window" position="flex-start" size="92" width="644" height="645" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse v2 Expander_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse v2 Expander_3.png" showCaption="false"} Click the **Test Credentials** button to ensure the credentials are correct and have the necessary access to make Xpanse API calls. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/HGzMAj0PmqgKYqAulZwW__palo-alto-xpanse-expander4.png" alt="Expander Connector - Test Credentials" position="flex-start" size="28" width="195" height="136" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander_4.png" showCaption="false"} Under *Schedule*, configure the desired schedule for the connector to retrieve results from the Expander instance. ![Expander Connector - Schedule Options](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/CfxhJg05_lyWiSyZYrYgC_palo-alto-xpanse-v2-expander5.png) Click the **Save** button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the *Integrations* page under **Currently Configured Integrations**. Clicking the **History** button displays the connector details for each pull. The **Sync** button allows users to perform on-demand sync. The **Edit** button allows the user to edit the connector configuration. The **Delete** button allows the user to delete the connector. Once files have been processed on the Uploads page, view the ingested data by navigating to the **Hosts** and **Host Findings** pages. ### Optional Configurations You can bring in the asset tags into the configuration by selecting "**Yes, bring in asset tags**" under the Optional Configurations section. ### Editing a Connector Configuration Connector configurations can be updated at any time after creation. Go to the **Automate** > **Integrations** page and select the specific connector you want to update. ## Utilizing the Connector The data from Palo Alto Networks Cortex Xpanse API is ingested into Ivanti Neurons for RBVM as Hosts and Host Findings. The **Scanner Name** associated with these scans is **Expander V2**. Scanner Name can be used as a filter for Hosts and Host Findings. ## Assets All assets from the Palo Alto Networks Cortex Xpanse API are shown on the Hosts page. **Ivanti Neurons RBVM Tags** The following fields from Cortex Xpanse APIs are converted into RBVM asset tags. These tags can be used for searching, playbook automation, and better visualization in RBVM Dashboards. - data > annotations > tags > name ## Findings All findings from the Palo Alto Networks Cortex Xpanse API are shown on the **Manage** -> **Host Findings** page. The Cortex Xpanse service parser creates a finding for each inferred CVE associated with a service. If a service does not contain any inferred CVE information, it is skipped, and no findings are generated for that service. The scanner uses a full synchronization model, ensuring that all eligible service data is processed during each scan. ## Connector Data Mapping This table showcases the high-level mapping of Xpanse API fields in Ivanti Neurons for RBVM. ### Host | **RBVM Field** | **Mapping Field** | | --------------------------------------------------------- | ------------------------------------------------------------------------------------- | | Expander Agent Id | reply.assets\_internet\_exposure.agent\_id | | Expander Annotation | reply.assets\_internet\_exposure.annotation | | Expander Asm Va Score | reply.assets\_internet\_exposure.asm\_va\_score | | Expander ASN Countries | reply.assets\_internet\_exposure.asn\_countries | | Expander ASN Handles | reply.assets\_internet\_exposure.asn\_handles | | Expander ASN Record Names | reply.assets\_internet\_exposure.asn\_record\_names | | Expander ASN Registries | reply.assets\_internet\_exposure.asn\_registries | | Expander Asset Explainers | reply.assets\_internet\_exposure.asset\_explainers | | Expander AWS Cloud Tags | reply.assets\_internet\_exposure.aws\_cloud\_tags | | Expander Azure Cloud Tags | reply.assets\_internet\_exposure.azure\_cloud\_tags | | Expander Business Units Creation Times | reply.assets\_internet\_exposure.business\_units.creation\_time | | Expander Business Units IDs | reply.assets\_internet\_exposure.business\_units.id | | Expander Business Units Names | reply.assets\_internet\_exposure.business\_units.name | | Expander Business Units Parent IDs | reply.assets\_internet\_exposure.business\_units.parent\_id | | Expander Business Units Update Times | reply.assets\_internet\_exposure.business\_units.update\_time | | Expander Certificate Algorithm | reply.assets\_internet\_exposure.certificate\_algorithm | | Expander Certificate Classifications | reply.assets\_internet\_exposure.certificate\_classifications | | Expander Certificate Expiry Date | reply.assets\_internet\_exposure.certificate\_expiry\_date | | Expander Certificate Formatted Issuer Org | reply.assets\_internet\_exposure.certificate\_details.formattedIssuerOrg | | Expander Certificate Hash | reply.assets\_internet\_exposure.certificate\_hash | | Expander Certificate Issuer | reply.assets\_internet\_exposure.certificate\_issuer | | Expander Certificate Issuer Alternative Names | reply.assets\_internet\_exposure.certificate\_details.issuerAlternativeNames | | Expander Certificate Issuer Country | reply.assets\_internet\_exposure.certificate\_details.issuerCountry | | Expander Certificate Issuer Email | reply.assets\_internet\_exposure.certificate\_details.issuerEmail | | Expander Certificate Issuer Locality | reply.assets\_internet\_exposure.certificate\_details.issuerLocality | | Expander Certificate Issuer Name | reply.assets\_internet\_exposure.certificate\_details.issuerName | | Expander Certificate Issuer Org | reply.assets\_internet\_exposure.certificate\_details.issuerOrg | | Expander Certificate Issuer Org Unit | reply.assets\_internet\_exposure.certificate\_details.issuerOrgUnit | | Expander Certificate Issuer State | reply.assets\_internet\_exposure.certificate\_details.issuerState | | Expander Certificate MD5 Fingerprint | reply.assets\_internet\_exposure.certificate\_details.md5Fingerprint | | Expander Certificate Public Key Algorithm | reply.assets\_internet\_exposure.certificate\_public\_key\_algorithm | | Expander Certificate Public Key Bits | reply.assets\_internet\_exposure.certificate\_public\_key\_bits | | Expander Certificate Publickey | reply.assets\_internet\_exposure.certificate\_details.publicKey | | Expander Certificate Publickey Algorithm | reply.assets\_internet\_exposure.certificate\_details.publicKeyAlgorithm | | Expander Certificate Publickey Bits | reply.assets\_internet\_exposure.certificate\_details.publicKeyBits | | Expander Certificate Publickey Modulus | reply.assets\_internet\_exposure.certificate\_details.publicKeyModulus | | Expander Certificate Publickey RSA Exponent | reply.assets\_internet\_exposure.certificate\_details.publicKeyRsaExponent | | Expander Certificate Publickey SPKI | reply.assets\_internet\_exposure.certificate\_details.publicKeySpki | | Expander Certificate Serial Number | reply.assets\_internet\_exposure.certificate\_serial\_number | | Expander Certificate Sha1 Fingerprint | reply.assets\_internet\_exposure.certificate\_details.sha1Fingerprint | | Expander Certificate Sha256 Fingerprint | reply.assets\_internet\_exposure.certificate\_details.sha256Fingerprint | | Expander Certificate Signature Algorithm | reply.assets\_internet\_exposure.certificate\_details.signatureAlgorithm | | Expander Certificate Subject | reply.assets\_internet\_exposure.certificate\_details.subject | | Expander Certificate Subject Alt Names | reply.assets\_internet\_exposure.certificate\_subject\_alt\_names | | Expander Certificate Subject Alternative Names | reply.assets\_internet\_exposure.certificate\_details.subjectAlternativeNames | | Expander Certificate Subject Country | reply.assets\_internet\_exposure.certificate\_details.subjectCountry | | Expander Certificate Subject Email | reply.assets\_internet\_exposure.certificate\_details.subjectEmail | | Expander Certificate Subject Locality | reply.assets\_internet\_exposure.certificate\_details.subjectLocality | | Expander Certificate Subject Name | reply.assets\_internet\_exposure.certificate\_details.subjectName | | Expander Certificate Subject Org | reply.assets\_internet\_exposure.certificate\_details.subjectOrg | | Expander Certificate Subject Org Unit | reply.assets\_internet\_exposure.certificate\_details.subjectOrgUnit | | Expander Certificate Subject Organization | reply.assets\_internet\_exposure.certificate\_subject\_organization | | Expander Certificate Subject Organization Unit | reply.assets\_internet\_exposure.certificate\_subject\_organization\_unit | | Expander Certificate Subject State | reply.assets\_internet\_exposure.certificate\_details.subjectState | | Expander Certificate Valid Not After | reply.assets\_internet\_exposure.certificate\_details.validNotAfter | | Expander Certificate Valid Not Before | reply.assets\_internet\_exposure.certificate\_details.validNotBefore | | Expander Certificate Version | reply.assets\_internet\_exposure.certificate\_details.version | | Expander Cloud Id | reply.assets\_internet\_exposure.cloud\_id | | Expander Cloud Provider | reply.assets\_internet\_exposure.cloud\_provider | | Expander Cloud Resource Type | reply.assets\_internet\_exposure.cloud\_resource\_type | | Expander Creation Time | reply.assets\_internet\_exposure.creation\_time | | Expander Date Added | reply.assets\_internet\_exposure.date\_added | | Expander Domain | reply.assets\_internet\_exposure.domain | | Expander Domain Admin Email | reply.assets\_internet\_exposure.domain\_admin\_email | | Expander Domain Admin Name | reply.assets\_internet\_exposure.domain\_admin\_name | | Expander Domain Admin Organization | reply.assets\_internet\_exposure.domain\_admin\_organization | | Expander Domain Administrator City | reply.assets\_internet\_exposure.domain\_details.admin.city | | Expander Domain Administrator Country | reply.assets\_internet\_exposure.domain\_details.admin.country | | Expander Domain Administrator Emailaddress | reply.assets\_internet\_exposure.domain\_details.admin.emailAddress | | Expander Domain Administrator Faxextension | reply.assets\_internet\_exposure.domain\_details.admin.faxExtension | | Expander Domain Administrator Faxnumber | reply.assets\_internet\_exposure.domain\_details.admin.faxNumber | | Expander Domain Administrator Name | reply.assets\_internet\_exposure.domain\_details.admin.name | | Expander Domain Administrator Organization | reply.assets\_internet\_exposure.domain\_details.admin.organization | | Expander Domain Administrator Phoneextension | reply.assets\_internet\_exposure.domain\_details.admin.phoneExtension | | Expander Domain Administrator Phonenumber | reply.assets\_internet\_exposure.domain\_details.admin.phoneNumber | | Expander Domain Administrator Postalcode | reply.assets\_internet\_exposure.domain\_details.admin.postalCode | | Expander Domain Administrator Province | reply.assets\_internet\_exposure.domain\_details.admin.province | | Expander Domain Administrator Registry ID | reply.assets\_internet\_exposure.domain\_details.admin.registryId | | Expander Domain Administrator Street | reply.assets\_internet\_exposure.domain\_details.admin.street | | Expander Domain Aligned Registrar | reply.assets\_internet\_exposure.domain\_details.alignedRegistrar | | Expander Domain Collection Time | reply.assets\_internet\_exposure.domain\_details.collectionTime | | Expander Domain Creation Date | reply.assets\_internet\_exposure.domain\_details.creationDate | | Expander Domain DNSSEC | reply.assets\_internet\_exposure.domain\_details.dnssec | | Expander Domain Domain Statuses | reply.assets\_internet\_exposure.domain\_details.domainStatuses | | Expander Domain Expiry Date | reply.assets\_internet\_exposure.domain\_expiry\_date | | Expander Domain Name Servers | reply.assets\_internet\_exposure.domain\_details.nameServers | | Expander Domain Registrant City | reply.assets\_internet\_exposure.domain\_details.registrant.city | | Expander Domain Registrant Country | reply.assets\_internet\_exposure.domain\_details.registrant.country | | Expander Domain Registrant Email | reply.assets\_internet\_exposure.domain\_registrant\_email | | Expander Domain Registrant Email Address | reply.assets\_internet\_exposure.domain\_details.registrant.emailAddress | | Expander Domain Registrant Fax Extension | reply.assets\_internet\_exposure.domain\_details.registrant.faxExtension | | Expander Domain Registrant Fax Number | reply.assets\_internet\_exposure.domain\_details.registrant.faxNumber | | Expander Domain Registrant Name | reply.assets\_internet\_exposure.domain\_registrant\_name | | Expander Domain Registrant Organization | reply.assets\_internet\_exposure.domain\_registrant\_organization | | Expander Domain Registrant Phone Extension | reply.assets\_internet\_exposure.domain\_details.registrant.phoneExtension | | Expander Domain Registrant Phone Number | reply.assets\_internet\_exposure.domain\_details.registrant.phoneNumber | | Expander Domain Registrant Postal Code | reply.assets\_internet\_exposure.domain\_details.registrant.postalCode | | Expander Domain Registrant Province | reply.assets\_internet\_exposure.domain\_details.registrant.province | | Expander Domain Registrant Registry ID | reply.assets\_internet\_exposure.domain\_details.registrant.registryId | | Expander Domain Registrant Street | reply.assets\_internet\_exposure.domain\_details.registrant.street | | Expander Domain Registrar Abuse Contact Email | reply.assets\_internet\_exposure.domain\_details.registrar.abuseContactEmail | | Expander Domain Registrar Abuse Contact Phone | reply.assets\_internet\_exposure.domain\_details.registrar.abuseContactPhone | | Expander Domain Registrar Aligned Name | reply.assets\_internet\_exposure.domain\_details.registrar.alignedName | | Expander Domain Registrar IANA ID | reply.assets\_internet\_exposure.domain\_details.registrar.ianaId | | Expander Domain Registrar Name | reply.assets\_internet\_exposure.domain\_details.registrar.name | | Expander Domain Registrar Registration Expiration Date | reply.assets\_internet\_exposure.domain\_details.registrar.registrationExpirationDate | | Expander Domain Registrar URL | reply.assets\_internet\_exposure.domain\_details.registrar.url | | Expander Domain Registrar Whois Server | reply.assets\_internet\_exposure.domain\_details.registrar.whoisServer | | Expander Domain Registry Domain ID | reply.assets\_internet\_exposure.domain\_details.registryDomainId | | Expander Domain Registry Expiry Date | reply.assets\_internet\_exposure.domain\_details.registryExpiryDate | | Expander Domain Reseller | reply.assets\_internet\_exposure.domain\_details.reseller | | Expander Domain Resolves | reply.assets\_internet\_exposure.domain\_resolves | | Expander Domain Retrieved Date | reply.assets\_internet\_exposure.domain\_details.retrievedDate | | Expander Domain Tech City | reply.assets\_internet\_exposure.domain\_details.tech.city | | Expander Domain Tech Country | reply.assets\_internet\_exposure.domain\_details.tech.country | | Expander Domain Tech Emailaddress | reply.assets\_internet\_exposure.domain\_details.tech.emailAddress | | Expander Domain Tech Faxextension | reply.assets\_internet\_exposure.domain\_details.tech.faxExtension | | Expander Domain Tech Faxnumber | reply.assets\_internet\_exposure.domain\_details.tech.faxNumber | | Expander Domain Tech Name | reply.assets\_internet\_exposure.domain\_details.tech.name | | Expander Domain Tech Organization | reply.assets\_internet\_exposure.domain\_details.tech.organization | | Expander Domain Tech Phoneextension | reply.assets\_internet\_exposure.domain\_details.tech.phoneExtension | | Expander Domain Tech Phonenumber | reply.assets\_internet\_exposure.domain\_details.tech.phoneNumber | | Expander Domain Tech Postalcode | reply.assets\_internet\_exposure.domain\_details.tech.postalCode | | Expander Domain Tech Province | reply.assets\_internet\_exposure.domain\_details.tech.province | | Expander Domain Tech Registryid | reply.assets\_internet\_exposure.domain\_details.tech.registryId | | Expander Domain Tech Street | reply.assets\_internet\_exposure.domain\_details.tech.street | | Expander Domain Updated Date | reply.assets\_internet\_exposure.domain\_details.updatedDate | | Expander Extended Properties Last Start Time | reply.assets\_internet\_exposure.extended\_properties.last\_start\_time | | Expander Extended Properties Machine Type | reply.assets\_internet\_exposure.extended\_properties.machine\_type | | Expander Extended Properties Network Interfaces Id | reply.assets\_internet\_exposure.extended\_properties.network\_interfaces.id | | Expander Extended Properties Network Interfaces Ip | reply.assets\_internet\_exposure.extended\_properties.network\_interfaces.ip | | Expander Extended Properties Network Interfaces Name | reply.assets\_internet\_exposure.extended\_properties.network\_interfaces.name | | Expander Extended Properties Network Interfaces Subnet Id | reply.assets\_internet\_exposure.extended\_properties.network\_interfaces.subnet\_id | | Expander Extended Properties Network Interfaces Vpc Id | reply.assets\_internet\_exposure.extended\_properties.network\_interfaces.vpc\_id | | Expander Extended Properties Private Ips | reply.assets\_internet\_exposure.extended\_properties.private\_ips | | Expander Extended Properties Public Ips | reply.assets\_internet\_exposure.extended\_properties.public\_ips | | Expander Extended Properties Volumes Boot | reply.assets\_internet\_exposure.extended\_properties.volumes.boot | | Expander Extended Properties Volumes Id | reply.assets\_internet\_exposure.extended\_properties.volumes.id | | Expander Extended Properties Volumes Name | reply.assets\_internet\_exposure.extended\_properties.volumes.name | | Expander Extended Properties Volumes Type | reply.assets\_internet\_exposure.extended\_properties.volumes.type | | Expander External Ips | reply.assets\_internet\_exposure.external\_ips | | Expander Externally Detected Providers | reply.assets\_internet\_exposure.externally\_detected\_providers | | Expander GCP Cloud Tags | reply.assets\_internet\_exposure.gcp\_cloud\_tags | | Expander Geo Region | reply.assets\_internet\_exposure.geo\_region | | Expander Has Active Externally Services | reply.assets\_internet\_exposure.has\_active\_externally\_services | | Expander Has Alerts | reply.assets\_internet\_exposure.has\_alerts | | Expander Has BU Overrides | reply.assets\_internet\_exposure.has\_bu\_overrides | | Expander Has Incidents | reply.assets\_internet\_exposure.has\_incidents | | Expander Has XDR Agent | reply.assets\_internet\_exposure.has\_xdr\_agent | | Expander Hierarchy | reply.assets\_internet\_exposure.hierarchy | | Expander Internal Ips | reply.assets\_internet\_exposure.internal\_ips | | Expander Iot Category | reply.assets\_internet\_exposure.iot\_category | | Expander Iot Model | reply.assets\_internet\_exposure.iot\_model | | Expander Iot Profile | reply.assets\_internet\_exposure.iot\_profile | | Expander Ip Ranges | reply.assets\_internet\_exposure.ip\_ranges | | Expander Ips | reply.assets\_internet\_exposure.ips | | Expander Is Paid Level Domain | reply.assets\_internet\_exposure.is\_paid\_level\_domain | | Expander Mac Addresses | reply.assets\_internet\_exposure.mac\_addresses | | Expander Management Status | reply.assets\_internet\_exposure.management\_status | | Expander Open Ports | reply.assets\_internet\_exposure.open\_ports | | Expander Operation System | reply.assets\_internet\_exposure.operation\_system | | Expander Project Name | reply.assets\_internet\_exposure.project\_name | | Expander Provider Account | reply.assets\_internet\_exposure.provider\_account | | Expander Recent IPs First Observed | reply.assets\_internet\_exposure.recent\_ips.firstObserved | | Expander Recent IPs Id | reply.assets\_internet\_exposure.recent\_ips.id | | Expander Recent IPs Ip | reply.assets\_internet\_exposure.recent\_ips.ip | | Expander Recent IPs Ipv6 | reply.assets\_internet\_exposure.recent\_ips.ipv6 | | Expander Recent IPs Last Observed | reply.assets\_internet\_exposure.recent\_ips.lastObserved | | Expander Recent IPs Provider Additionalproviderinfo | reply.assets\_internet\_exposure.recent\_ips.provider.additionalProviderInfo | | Expander Recent IPs Provider CDN | reply.assets\_internet\_exposure.recent\_ips.provider.cdn | | Expander Recent IPs Provider Display Name | reply.assets\_internet\_exposure.recent\_ips.provider.displayName | | Expander Recent IPs Provider ISCDN | reply.assets\_internet\_exposure.recent\_ips.provider.isCdn | | Expander Recent IPs Provider Legacyname | reply.assets\_internet\_exposure.recent\_ips.provider.legacyName | | Expander Recent IPs Provider Name | reply.assets\_internet\_exposure.recent\_ips.provider.name | | Expander Recent IPs Source Name | reply.assets\_internet\_exposure.recent\_ips.source.name | | Expander Region | reply.assets\_internet\_exposure.region | | Expander Sensor | reply.assets\_internet\_exposure.sensor | | Expander Service Type | reply.assets\_internet\_exposure.service\_type | | Expander Sub Region | reply.assets\_internet\_exposure.sub\_region | | Expander VPC Name ID | reply.assets\_internet\_exposure.vpc\_name\_id | ### Host Finding Mapping | **RBVM Field** | **Mapping Field** | | -------------------------------------- | ------------------------------------------------------------------------------------------------------- | | Expander Service Type | external\_services -> service\_type | | Expander Inferred CVE Confidence | external\_services -> inferred\_cves\_observed -> inferredCve -> inferredCveMatchMetadata -> confidence | | Expander Service Versions | external\_services -> service\_versions | | Expander Vulnerability Type | "**INFERRED**" - external\_services -> inferred\_cves\_observed -> inferredCve | | Expander Discovery Type | external\_services -> discovery\_type | | Expander Service Is Active | external\_services -> is\_active | | Expander Externally Detected Providers | external\_services -> externally\_detected\_providers | | Expander Service Id | external\_services -> service\_id | | Expander Service Type | external\_services -> service\_type | | Expander Active Classification | external\_services -> active\_classifications | | Expander In Active Classification | external\_services -> inactive\_classifications | | Expander Business Unit Id | external\_services -> business\_units -> id | | Expander Business Unit Name | external\_services -> business\_units -> name | | Expander Tags | external\_services -> tags |