Avalor (Zscaler)

Overview

The Avalor (Zscaler) integration connects the Praetorian Guard Platform (PGP) with Avalor's security data fabric, now part of Zscaler. Avalor aggregates and normalizes security data across your entire stack — vulnerability scanners, endpoint tools, cloud platforms, and identity systems — and produces unified risk analytics and posture scores. By importing this consolidated data into PGP, you gain a single view of your security posture enriched with Avalor's cross-source risk correlation, without needing to configure each underlying tool individually.

This integration is designed for organizations that use Avalor as their central security data aggregation layer. Rather than duplicating integrations, PGP pulls the already-normalized asset inventory, risk scores, and posture findings from Avalor, combining them with PGP's continuous threat exposure management capabilities. The result is a more complete picture of your attack surface backed by Avalor's data fabric analytics.

What the Integration Does

When connected, PGP performs a read-only import from the Avalor API:

  • Assets: Avalor's unified asset inventory — servers, endpoints, cloud resources, applications, and identities — is imported into PGP as assets. Each asset includes normalized metadata aggregated from the underlying security tools feeding into Avalor.
  • Risk Scores and Posture Data: Risk analytics produced by Avalor, including composite risk scores, coverage gaps, and posture assessments, are imported as risk metadata attached to the corresponding PGP assets.
  • Security Findings: Vulnerability and misconfiguration findings that Avalor has correlated across multiple data sources are imported into PGP, providing deduplicated and enriched risk context.

    • Data flows one direction only — from Avalor into PGP. The integration never writes back to Avalor or modifies any data in the Avalor platform.

    Prerequisites

    Before setting up the integration, you need Avalor API credentials:

  • Log in to the [Avalor platform](https://app.avalor.io) (or your Zscaler-provisioned Avalor instance)
  • Navigate to Settings > API Access
  • Click Generate API Key
  • Record the following values:
  • API Key: The generated key for authenticating API requests
  • Avalor Instance URL: Your Avalor tenant URL (e.g., https://your-org.avalor.io)
  • Ensure the API key has read-only permissions to asset and risk data

    • The API key must have sufficient scope to read assets, findings, and risk scores from your Avalor tenant.

    Setup

  • Go to Integrations, then Security Analytics, then Avalor (Zscaler) in the Guard Platform
  • Enter your Avalor API credentials in the setup form
  • Click Connect — PGP will validate your credentials by attempting to fetch asset data before saving
    • FieldDescriptionRequired
    Instance URLYour Avalor tenant URL (e.g., https://your-org.avalor.io)Yes
    API KeyThe API key generated from Avalor's API Access settingsYes

    If validation fails, verify that your API key has the correct read permissions and that the instance URL matches your Avalor tenant.

    What Data Is Synced

    Assets

    Avalor's unified asset inventory is imported with:

  • Asset name: Derived from the asset identifier in Avalor (hostname, IP, cloud resource ID)
  • Asset type: Mapped from Avalor's asset classification (server, endpoint, cloud resource, application)
  • Metadata: Source tools, risk score, coverage status, last seen timestamp, and business context tags

    • Risk Analytics

    Risk posture data from Avalor is attached to corresponding assets:

    Avalor DataPGP Mapping
    Composite risk scoreRisk metadata on asset
    Coverage gaps (missing agent, missing scanner)Risk finding
    Posture assessment resultsRisk metadata on asset
    Correlated vulnerability findingsRisk finding with severity

    Security Findings

    Deduplicated findings from Avalor are imported as risks:

  • Finding name: Vulnerability or misconfiguration title from Avalor
  • Severity: Mapped from Avalor's normalized severity (critical, high, medium, low)
  • Source tools: List of underlying tools that contributed to the finding
  • Affected asset: Linked to the corresponding PGP asset

    • API Endpoints Used

    EndpointMethodPurpose
    /api/v1/assetsGETFetch unified asset inventory
    /api/v1/assets/{id}/risksGETFetch risk scores and posture data for an asset
    /api/v1/findingsGETFetch correlated security findings
    /api/v1/findings/{id}GETFetch detailed finding metadata
    /api/v1/sourcesGETFetch connected data source status

    Base URL: Your Avalor instance URL (e.g., https://your-org.avalor.io)

    All requests are authenticated using the API key passed in the request header over HTTPS.

    Troubleshooting

    IssueCauseFix
    Validation fails on connectAPI key is incorrect or expiredRegenerate the API key in Avalor under Settings > API Access
    No assets appearingAPI key lacks read permissions for asset dataVerify the API key scope includes asset and finding read access
    Missing risk scoresRisk analytics have not been computed for imported assetsEnsure Avalor has completed at least one data aggregation cycle for your connected sources
    Stale dataAvalor data sources are not syncingCheck the data source status in Avalor to confirm upstream integrations are active
    Connection timeoutNetwork or firewall blocking outbound requests to AvalorVerify that PGP can reach your Avalor instance URL over HTTPS (port 443)

    Security and Data Handling

  • Read-only access: The integration only reads data from Avalor. It never creates, modifies, or deletes assets, findings, or configurations in the Avalor platform.
  • Credential handling: Your API key is stored as an encrypted credential within PGP and is never exposed in logs or the UI after initial entry.
  • Authentication: The API key is transmitted over HTTPS in request headers for every API call.
  • Data filtering: Imported assets and findings pass through PGP standard filtering rules, allowing you to control which data is included in your attack surface.