Connectors

A connector is a credential-backed integration that allows Nexplane to discover assets and execute changes in an external system. Each connector stores its credentials encrypted and exposes typed actions that map to Nexplane change types.

Cloud & Infrastructure

Connector	Key Capabilities
AWS	EC2 lifecycle, IAM, S3, Route53, RDS, CloudWatch, ALB, security groups, SSM, Tailscale, agent deploy
Azure	VM lifecycle, NSG, blob storage, managed identity, RBAC, VNet, DNS, SQL, Monitor alerts, Entra users
GCP	Compute lifecycle, firewall rules, storage, service accounts, IAM, SCC
OCI	Compute lifecycle, VCN/NSG/security lists, object storage, block volumes, IAM, ADB, MySQL, DNS, Vault, monitoring
Cloudflare	WAF, firewall rules, access policies, block IP, SSL mode, DNS
Palo Alto	Address objects, rules, zones, block IP, commit
OPNsense	Firewall rules, block host
Zscaler	URL/IP blocking, user suspension, URL category management
Tailscale	Join/remove nodes, auth key management

Identity & Access

Connector	Key Capabilities
Okta	User disable/enable, group management, MFA enforcement, session revoke, API token rotation
Active Directory	Discover/disable stale accounts, move OU, rotate service account passwords
Microsoft Entra ID	User disable/enable, revoke sessions, assign/remove license, remove from Teams
Azure AD (Graph API)	User disable, user create via Microsoft Graph
LDAP	Disable user accounts via pwdAccountLockedTime
FreeIPA	Disable user accounts via JSON-RPC
Keycloak	Disable user and revoke sessions
Teleport	Lock user via tctl
HashiCorp Vault	Secret discovery, dynamic credentials, secret rotation
Infisical	Secret rotation
Microsoft LAPS	Retrieve and rotate LAPS-managed local admin passwords

Code & Version Control

Connector	Key Capabilities
GitHub	Org member management, PAT revocation, branch protection, repo management
GitLab	User suspension, PAT rotation
Gitea	User suspension
JFrog Xray	Artifact scanning, policy violation sync

Security Tools & EDR

Connector	Key Capabilities
CrowdStrike	Isolate host, RTR commands, prevention policy, host containment
Microsoft Defender for Endpoint	Machine isolation, antivirus scan, investigation, TVM vulnerability ingest
SentinelOne	Endpoint discovery, alert ingest
Wazuh	Agent registration
Falco	Runtime security rule management via SSM

Vulnerability Scanners

Connector	Key Capabilities
Tenable	Launch/pause/resume scans, export findings
Snyk	Vulnerability findings ingest
Qualys	Vulnerability findings ingest, scan launch
OpenVAS	Run scans, import CVE findings
Nessus	Run vulnerability scans
Wiz	Cloud security findings, misconfiguration discovery
RunZero	Network asset discovery
Elastic Security	Security alert sync, detection rule creation

SaaS

Connector	Key Capabilities
Google Workspace	User suspension, group removal, 2FA reset, OAuth token revocation, device wipe
Slack	User deactivation/reactivation
Kubernetes	Deployment restart/scale, network policy, RBAC, secret rotation, Helm
Helm	Upgrade/rollback Kubernetes releases

IaC & Configuration

Connector	Key Capabilities
Terraform (Local)	Apply/destroy in backend container, AWS credentials injected
Terraform (Remote)	Two-phase plan→apply via external workspace
Ansible (AWX)	Launch AWX job templates, manage inventories
Ansible (Local)	Run playbooks via SSM transport
Ansible (Remote)	Remote playbook execution
SaltStack	Run states/functions on minions, manage keys
AWS CloudFormation	Stack management, drift detection, change sets
Azure Bicep	ARM/Bicep template deployments
Pulumi	Stack discovery, cancel/refresh operations
Checkov	IaC security scanning, secrets detection
Chef InSpec	Compliance scanning via Chef Automate
step-ca	TLS certificate rotation and expiry checking

Windows Management

Connector	Key Capabilities
Microsoft Intune	Device discovery, policy sync, script deployment
SCCM / MECM	Application deployment, script execution, inventory collection
Windows Update for Business	Update ring management, compliance checking
WinRM	Agent bootstrap on Windows hosts

Workflow & Observability

Connector	Key Capabilities
Jira	Ticket creation and status sync
PagerDuty	Incident creation, alert routing
ServiceNow	Change request sync
Splunk	Event ingest, search query execution
Datadog	Monitor ingest, alert creation

Databases

Connector	Key Capabilities
PostgreSQL	User password rotation via direct connection
Redis	AUTH password rotation
MongoDB	User password rotation

Host Execution

Connector	Key Capabilities
SSH	Execute approved command templates on Linux/Unix hosts
Nexplane Agent Connector	Full OS hardening + all 15 agent command packages

Adding a Connector

1. Go to Connectors → Add Connector
2. Select the connector type
3. Fill in the credential fields (see each connector's page)
4. Click Save — credentials are encrypted before storage
5. Click Test Connection to verify
6. Click Trigger Ingest to populate asset inventory

Credential Security

Connector credentials are encrypted with Fernet AES-256 via SecretsService before being written to the database. They are decrypted in memory only during connector operation execution and are never logged or returned in API responses.

See Credential Storage for full details.