> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/nozomi.md).

# Nozomi Networks

Connect Nozomi Networks (Vantage or Guardian) to pull your OT and IoT asset inventory into Dispel, map vendor sites to Wickets, and keep device data and vulnerability findings in sync.

## Overview

The Nozomi Networks integration lets Dispel pull the OT and IoT asset inventory that Nozomi has discovered on your network and bring those assets in as Dispel devices. You connect once, map each Nozomi site to a Dispel facility and Wicket, and Dispel imports the matching devices and keeps them up to date on a recurring sync.

Nozomi is an **asset-discovery** integration. Dispel reads from Nozomi — it never writes back to your Nozomi console.

A single integration supports both Nozomi deployment types, selected when you connect:

* **Vantage** — Nozomi's cloud platform, with centralized risk management across all of your sites.
* **Guardian** — an on-premise Nozomi appliance, with comprehensive asset inventory and network visibility for a single environment.

#### What Dispel imports

* Discovered assets (name, IP address, MAC address, make/model, operating system, firmware) as Dispel devices.
* Observed network protocols and ports for each asset.
* A link back to the asset in your Nozomi console, plus Nozomi's risk score, stored on the device.
* **Vulnerability findings** for each imported device, refreshed on every sync.

{% hint style="info" %}
**Where to find it.** Sign in as an organization administrator and open **Settings → Integrations**. Nozomi appears in the **Asset Discovery / Network Visibility** section. Click **Connect** on the Nozomi card to begin.
{% endhint %}

## Before you begin

You'll need the following from your Nozomi console:

* An **API key** — its **Key Name** (the identifier) and **Key Token** (the secret). Generate this in your Nozomi console.
* The **API URL** of your deployment:
  * For Vantage, your tenant URL — for example `https://customer.vantage.nozominetworks.io`.
  * For Guardian, the URL of your appliance.

{% hint style="warning" %}
**Allowlist Dispel's IP.** When you open the connection form, Dispel shows a **Whitelist IP** value. Add this address to your Nozomi (or network firewall) allowlist so Dispel can reach the API — this is especially important for on-premise Guardian appliances.
{% endhint %}

## Connecting Nozomi

1. Go to **Settings → Integrations** and click **Connect** on the Nozomi card.
2. Optionally set a **Display Name** to tell this integration apart from others (you can connect more than one Nozomi).
3. Choose the **Nozomi API Type** — **Vantage API** or **Guardian API**.
4. Fill in the connection fields:

| Field         | Type       | Notes                                                             |
| ------------- | ---------- | ----------------------------------------------------------------- |
| **API URL**   | Config     | Your Vantage tenant URL or Guardian appliance URL.                |
| **Key Name**  | Credential | The API key identifier from your Nozomi console.                  |
| **Key Token** | Credential | The secret API key token. Stored encrypted and never shown again. |

5. Click **Test Connection** to confirm Dispel can authenticate against Nozomi. Fix any reported error before saving.
6. Click **Save**. Dispel saves the integration and immediately runs the initial sync to discover your Nozomi sites.

{% hint style="info" %}
**Your credentials are encrypted.** The Key Token (and any other secret) is encrypted at rest and is never displayed again after you save. When editing later, leave credential fields blank to keep the stored values.
{% endhint %}

## Mapping sites to Wickets

Once the initial sync finishes, open the integration to find the **Site Mapping** section. This is where you decide which Nozomi sites become Dispel devices and where they land.

> Map each vendor site to a Dispel facility and wicket. Devices from mapped sites will be synced into Dispel.

For each site you want to import:

1. Pick a **Facility**.
2. Pick a **Wicket**. If the facility has only one Wicket, Dispel selects it for you.
3. *(Optional)* Restrict the import to specific **Zones**. Nozomi tags assets with native zones; use the Zones picker to import only the assets in the zones you choose. Leave it empty to import every asset at the site.
4. Click **Save Mappings & Import**.

Dispel works through each mapped site — you'll see per-site progress move from waiting, to fetching, to syncing, to complete — and then reports how many devices were imported (for example, **"12 devices imported"** or a breakdown of new versus already-imported devices). Imported devices appear in the mapped Wicket alongside any devices you've added manually.

## Keeping your inventory current

* Dispel **re-syncs automatically** on a recurring schedule, so newly discovered assets and changed details are picked up without any action from you.
* To pull the latest inventory immediately, open the integration and choose **Refresh**.
* To change connection details or rotate credentials, edit the integration and use **Save & Sync**. Leave credential fields blank to keep the current secret.

## Vulnerability findings

Nozomi reports known vulnerabilities for the assets it monitors. After each successful sync, Dispel pulls the vulnerability findings for your imported devices and attaches them to those devices, so you can see a device's known issues without leaving Dispel. Findings are refreshed every sync, and resolved findings drop off automatically.

## Connection status

Each integration shows a status so you always know where it stands:

| Status              | Meaning                                                 |
| ------------------- | ------------------------------------------------------- |
| **Not Initialized** | Saved, but the first sync hasn't run yet.               |
| **Initializing**    | Running the first sync and discovering sites.           |
| **Ready**           | Connected and synced; mappings are applied.             |
| **Needs Refresh**   | New vendor data is available; run a refresh to pull it. |
| **Refreshing**      | A sync is in progress.                                  |
| **Pending Changes** | Mapping changes are saved but not yet applied.          |
| **Applying**        | Importing devices for your saved mappings.              |
| **Failed**          | The last operation failed — see the error guidance.     |

A separate **health badge** (Connected, Degraded, Unreachable) reflects whether Dispel can currently reach the Nozomi API.

## Troubleshooting

If a sync or test connection fails, Dispel classifies the error and suggests a fix:

| Error                     | What it usually means and how to fix it                                                                                              |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| **Authentication Failed** | The Key Name/Token was rejected. The key may have been rotated, expired, or revoked — generate a new one and update the integration. |
| **Endpoint Unreachable**  | Dispel couldn't reach the API. Verify the API URL and that Dispel's IP is allowlisted in your firewall.                              |
| **Connection Timed Out**  | The appliance took too long to respond — often network latency or a firewall rule. Common with on-prem Guardian.                     |
| **Rate Limited**          | Nozomi throttled requests. The next scheduled sync should succeed.                                                                   |
| **Configuration Error**   | The API URL or API type looks wrong (e.g. a Guardian URL with the Vantage type selected). Re-check the connection settings.          |

## Frequently asked questions

<details>

<summary>Can I connect more than one Nozomi deployment?</summary>

Yes. Nozomi supports multiple integrations, so you can connect several Guardian appliances and/or a Vantage tenant side by side. Give each a distinct **Display Name** to tell them apart.

</details>

<details>

<summary>Does connecting Nozomi change anything in my Nozomi console?</summary>

No. Dispel only reads from Nozomi. It never creates, modifies, or deletes data on the Nozomi side.

</details>

<details>

<summary>What happens to imported devices if I remove a site mapping?</summary>

Devices that are no longer covered by an active mapping stop being updated on subsequent syncs. Removing a mapping affects future syncs only — it doesn't retroactively delete history.

</details>

<details>

<summary>Why don't I see the Zones option?</summary>

Zone filtering is specific to Nozomi. The Zones picker only appears for sites whose assets carry Nozomi zone tags. If a site has no zones, all of its assets are imported.

</details>

<details>

<summary>How quickly do new assets appear?</summary>

New assets show up on the next sync — automatically on the recurring schedule, or immediately if you choose **Refresh**.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/nozomi.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.