{"resources":{"asset":{"id":"asset","name":"asset","fields":{"purl":{"name":"purl","type":"\u0007","title":"Package URL identifying the network device platform","desc":"Platform identity for the connected device encoded in the package URL (purl) format, giving a canonical string for the device's vendor, product, and version. Useful for correlating a device against vulnerability, advisory, and inventory data keyed by purl.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"is_extension":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco":{"id":"cisco","fields":{"interface":{"name":"interface","type":"\u001bcisco.interface","title":"Cisco interface name","desc":"Component parts of a Cisco interface name, parsed from a string such as `GigabitEthernet0/0/0/0`. Select an interface with the `iface` argument, for example `cisco.interface(iface: \"GigabitEthernet0/0/0/0\")`, then read `type`, `rack`, `slot`, `instance`, and `port` for the individual parts. The four numeric parts follow the Cisco IOS XR rack/slot/instance(module)/port notation; shorter names such as `GigabitEthernet0/0` leave the trailing parts unset. Used across the routing resources to attach an interface to a configuration entry.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ios":{"name":"ios","type":"\u001bcisco.ios","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"iosxe":{"name":"iosxe","type":"\u001bcisco.iosxe","title":"Cisco IOS XE network operating system","desc":"Configuration and operational state of a device running Cisco IOS XE, collected by running `show` commands over the device connection. Fields cover the hostname, domain names, interfaces and their configuration, SSH, CDP, DHCP, BOOTP, BGP, AAA, users and privilege levels, VTY/aux/console lines, access lists, key chains, SNMP, NTP, logging, RSA keys, and the global service and banner configuration. Use it to audit the security posture of an IOS XE router or switch.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"iosxr":{"name":"iosxr","type":"\u001bcisco.iosxr","title":"Cisco IOS XR network operating system","desc":"Configuration and operational state of a device running Cisco IOS XR, collected by running `show` commands over the device connection. Fields cover the hostname and interfaces, AAA (authentication, authorization, and accounting), SNMP, NTP, logging, SSH and crypto keys, CDP, password policies, line and VTY settings, and the routing protocols (BGP, OSPF, EIGRP, ISIS, RIP, VRRP, HSRP). Each field notes the `show` command it comes from. Use it to audit the hardening of an IOS XR router or switch.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"nxos":{"name":"nxos","type":"\u001bcisco.nxos","title":"Cisco NX-OS network operating system","desc":"Configuration and operational state of a device running Cisco NX-OS (Nexus data-center switches), collected by running `show` commands over the device connection. Fields cover the hostname, interfaces, users and roles, licensed features, TACACS+/RADIUS servers and AAA server groups, Control Plane Policing (CoPP), routing (BGP, OSPF, EIGRP, HSRP), the command scheduler, FIPS and boot settings, SSH, logging, SNMP, NTP, ACLs, password strength checking, passphrase and password-length policy, DHCP snooping, IPv6 RA Guard, line (vty and console) hardening, and login lockout. Use it to audit the security posture of a Nexus switch, for example `cisco.nxos.features.where(name == \"telnetServer\").all(state == \"disabled\")`.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"cisco.interface":{"id":"cisco.interface","name":"cisco.interface","fields":{"iface":{"name":"iface","type":"\u0007","is_mandatory":true,"title":"Interface string to parse, e.g. `GigabitEthernet0/0/0/0`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"instance":{"name":"instance","type":"\u0005","is_mandatory":true,"title":"Module / subslot (instance) number within the line card, e.g. 0","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port number on the module, e.g. 0","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"rack":{"name":"rack","type":"\u0005","is_mandatory":true,"title":"Rack (chassis) number, e.g. 0; always 0 on single-chassis platforms such as the ASR 9000","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"slot":{"name":"slot","type":"\u0005","is_mandatory":true,"title":"Line card slot number, e.g. 0; a Route Processor slot may be written as RP0","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Interface type keyword, e.g. `GigabitEthernet`, `TenGigE`, or `Loopback`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"init":{"args":[{"name":"iface","type":"\u0007"}]},"title":"Cisco interface name","desc":"Component parts of a Cisco interface name, parsed from a string such as `GigabitEthernet0/0/0/0`. Select an interface with the `iface` argument, for example `cisco.interface(iface: \"GigabitEthernet0/0/0/0\")`, then read `type`, `rack`, `slot`, `instance`, and `port` for the individual parts. The four numeric parts follow the Cisco IOS XR rack/slot/instance(module)/port notation; shorter names such as `GigabitEthernet0/0` leave the trailing parts unset. Used across the routing resources to attach an interface to a configuration entry.","defaults":"type rack slot instance port","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.ios":{"id":"cisco.ios","fields":{"inventoryEntry":{"name":"inventoryEntry","type":"\u001bcisco.ios.inventoryEntry","title":"Cisco device hardware inventory entry","desc":"A single physical or logical component reported by `show inventory`, such as the chassis, a line card, a power supply, or a transceiver, with its name, description, part number, version, and serial number.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"cisco.ios.inventoryEntry":{"id":"cisco.ios.inventoryEntry","name":"cisco.ios.inventoryEntry","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the inventory item (DESCR field)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Inventory item name, the slot or component label from `show inventory` (NAME field)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"partNumber":{"name":"partNumber","type":"\u0007","is_mandatory":true,"title":"Product identifier / part number of the item (PID field)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"productVersion":{"name":"productVersion","type":"\u0007","is_mandatory":true,"title":"Version identifier of the item (VID field)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number of the item (SN field)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco device hardware inventory entry","desc":"A single physical or logical component reported by `show inventory`, such as the chassis, a line card, a power supply, or a transceiver, with its name, description, part number, version, and serial number.","private":true,"defaults":"name description","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe":{"id":"cisco.iosxe","name":"cisco.iosxe","fields":{"aaa":{"name":"aaa","type":"\u001bcisco.iosxe.aaa","title":"Authentication, authorization, and accounting (AAA) configuration of the device","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aaaAuthentication":{"name":"aaaAuthentication","type":"\u001bcisco.iosxe.aaaAuthentication","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"aaaAuthenticationEnableEntry":{"name":"aaaAuthenticationEnableEntry","type":"\u001bcisco.iosxe.aaaAuthenticationEnableEntry","title":"Cisco IOS XE AAA enable authentication method list","desc":"A single `aaa authentication enable` line from the running-config, parsed from `show running-config | include aaa authentication enable`. Each entry defines the ordered methods used to authenticate elevation to privileged EXEC (enable) mode.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"aaaAuthenticationLoginEntry":{"name":"aaaAuthenticationLoginEntry","type":"\u001bcisco.iosxe.aaaAuthenticationLoginEntry","title":"Cisco IOS XE AAA login authentication method list","desc":"A single `aaa authentication login` line from the running-config, parsed from `show running-config | include aaa authentication login`. Each entry defines the ordered methods used to authenticate interactive login (console, vty, aux). Verifying that login lists use a remote server group before falling back to local, and never `none`, is a standard hardening check.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"accessListEntry":{"name":"accessListEntry","type":"\u001bcisco.iosxe.accessListEntry","title":"Cisco IOS XE IP access list","desc":"A named or numbered IP access list parsed from `show ip access-lists`, keyed on the acl name. The rules field holds the ordered permit/deny entries. Referenced from interface inbound/outbound bindings and SNMP community restrictions, so these lists define much of the device's packet- and management-plane filtering.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"accessLists":{"name":"accessLists","type":"\u0019\u001bcisco.iosxe.accessListEntry","title":"The access-lists configured on the device, obtained by running `show ip access-lists`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"accounting":{"name":"accounting","type":"\u001bcisco.iosxe.accounting","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"accountingEntry":{"name":"accountingEntry","type":"\u001bcisco.iosxe.accountingEntry","title":"Cisco IOS XE AAA accounting method definition","desc":"A single `aaa accounting` line from the running-config, parsed from `show running-config | include aaa accounting`. Each entry records what activity is audited (type), which named method list applies, when records are emitted, and where they are sent. Accounting coverage of exec sessions and level-15 commands is a common compliance requirement.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"auxLine":{"name":"auxLine","type":"\u001bcisco.iosxe.auxLineEntry","title":"The auxiliary (aux) line 0, obtained by running `show running-config all | sec line aux 0`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"auxLineEntry":{"name":"auxLineEntry","type":"\u001bcisco.iosxe.auxLineEntry","title":"Cisco IOS XE auxiliary (aux) line configuration","desc":"Console-equivalent settings for the auxiliary port (line aux 0), parsed from `show running-config all | sec line aux 0`. Because the aux port often has a modem attached and is a classic backdoor into a device, auditing its exec, privilege level, and idle timeout matters. The exec field reports whether an interactive EXEC session is allowed, privilegeLevel the level assigned on connect, and execTimeout the idle disconnect window.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"bgp":{"name":"bgp","type":"\u001bcisco.iosxe.bgpConfig","title":"Border Gateway Protocol (BGP) configuration obtained by running `show running-config all | sec router bgp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bgpConfig":{"name":"bgpConfig","type":"\u001bcisco.iosxe.bgpConfig","title":"BGP routing configuration on a Cisco IOS XE device","desc":"Border Gateway Protocol settings parsed from `show running-config all | sec router bgp`: the local autonomous system number and the configured neighbors. Traverse neighbors to audit peer authentication and remote-AS assignment, for example `.bgp.neighbors.all(password != \"\")` to require MD5 authentication on every peer.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"bootp":{"name":"bootp","type":"\u001bcisco.iosxe.bootpConfig","title":"Bootstrap protocol (BOOTP) configuration obtained by running `show running-config all | include bootp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bootpConfig":{"name":"bootpConfig","type":"\u001bcisco.iosxe.bootpConfig","title":"BOOTP service configuration on a Cisco IOS XE device","desc":"BOOTP server state derived from `show running-config all | include bootp`. The legacy BOOTP service is often disabled with `ip dhcp bootp ignore` as a hardening step. Audit with `.bootp.enabled == false`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"cdp":{"name":"cdp","type":"\u001bcisco.iosxe.cdpConfig","title":"Cisco Discovery Protocol (CDP) configuration obtained by running `show cdp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cdpConfig":{"name":"cdpConfig","type":"\u001bcisco.iosxe.cdpConfig","title":"CDP configuration on a Cisco IOS XE device","desc":"Global Cisco Discovery Protocol state parsed from `show cdp`. CDP advertises device identity, IOS version, and addressing to directly connected Cisco neighbors and is frequently disabled on untrusted or edge interfaces to limit information disclosure. Audit with `.cdp.enabled == false`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"config":{"name":"config","type":"\u001bcisco.iosxe.config","title":"Cisco IOS XE global configuration settings","desc":"Assorted device-wide configuration relevant to hardening: the `service` options, the enable password and secret credentials, and the exec, MOTD, and login banners. Each field runs a targeted `show running-config` filter. Use it to confirm that a strong enable secret is set (rather than a reversible enable password) and that required legal banners are present.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"configuration":{"name":"configuration","type":"\u001bcisco.iosxe.config","title":"The device's global configuration, including service settings, enable password and secret, and the exec, motd, and login banners.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleLine":{"name":"consoleLine","type":"\u001bcisco.iosxe.consoleLineEntry","title":"The console (con) line 0, obtained by running `show running-config all | sec line con 0`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleLineEntry":{"name":"consoleLineEntry","type":"\u001bcisco.iosxe.consoleLineEntry","title":"Cisco IOS XE console (con) line configuration","desc":"Settings for the local console port (line con 0), parsed from `show running-config all | sec line con 0`. The console is the physical management port, so its exec state, privilege level, and idle timeout are core hardening controls. The exec field reports whether an interactive EXEC session is allowed, privilegeLevel the level assigned on connect, and execTimeout the idle disconnect window.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"cryptoKeyRsa":{"name":"cryptoKeyRsa","type":"\u001bcisco.iosxe.cryptoKeyRsa","title":"RSA public key on a Cisco IOS XE device","desc":"An RSA key pair's public component parsed from `show crypto key mypubkey rsa`, selectable by label. Reports the key's label, type, usage, creation time, computed modulus size, and the raw public key material. The modulus size is the primary hardening signal: audit with `.cryptoKeysRsa.all(modulusSize \u003e= 2048)` to require adequately sized keys for SSH and PKI.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"cryptoKeysRsa":{"name":"cryptoKeysRsa","type":"\u0019\u001bcisco.iosxe.cryptoKeyRsa","title":"The RSA public keys configured on the device, obtained by running `show crypto key mypubkey rsa`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"dhcp":{"name":"dhcp","type":"\u001bcisco.iosxe.dhcpConfig","title":"Dynamic Host Configuration Protocol (DHCP) configuration obtained by running `show running-config all | include dhcp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"dhcpConfig":{"name":"dhcpConfig","type":"\u001bcisco.iosxe.dhcpConfig","title":"DHCP service configuration on a Cisco IOS XE device","desc":"DHCP service state derived from `show running-config all | include dhcp`. The on-device DHCP service is disabled with `no service dhcp`, which is a common hardening measure on devices that should not hand out addresses. Audit with `.dhcp.enabled == false`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"domainName":{"name":"domainName","type":"\u001bcisco.iosxe.domainName","title":"Cisco IOS XE default domain name","desc":"An `ip domain name` statement, giving the default domain appended to unqualified host names during DNS resolution. Parsed from `show running-config | include domain name`. Multiple entries can exist when per-VRF domain names are configured; vrfName distinguishes them.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"domainNames":{"name":"domainNames","type":"\u0019\u001bcisco.iosxe.domainName","title":"The default domain names configured on the device, obtained by running `show running-config | include domain name`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hostname":{"name":"hostname","type":"\u0007","title":"Configured hostname of the device, from `show running-config | section ^hostname`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.iosxe.interface","title":"Network interface on a Cisco IOS XE device","desc":"Operational interface state parsed from `show interfaces`, keyed by interface name. Reports link and protocol status, addressing, speed and duplex, and the running counters (packets, bit and packet rates, and error tallies such as CRC, runts, and giants) for each interface. Select an interface with `.interfaces.where(name == \"GigabitEthernet0/0\")`, and use config to reach the interface's running-config settings.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"interfaceConfig":{"name":"interfaceConfig","type":"\u001bcisco.iosxe.interfaceConfig","title":"Per-interface configuration on a Cisco IOS XE device","desc":"Interface-level settings parsed from `show running-config all | sec interface`, keyed by the interface name. Covers the security-relevant running-config of each interface: proxy ARP state, inbound and outbound access lists, unicast reverse path forwarding, and the EIGRP and OSPF routing-protocol settings bound to the interface. Select an interface with `.interfaceConfigs.where(name == \"GigabitEthernet0/0\")` to audit hardening such as proxy ARP being disabled or an ingress ACL being applied.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"interfaceConfigs":{"name":"interfaceConfigs","type":"\u0019\u001bcisco.iosxe.interfaceConfig","title":"Interface configurations obtained by running `show running-config all | sec interface`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interfaces":{"name":"interfaces","type":"\u0019\u001bcisco.iosxe.interface","title":"Interfaces on the device with their operational state, obtained by running `show interfaces`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inventory":{"name":"inventory","type":"\u0019\u001bcisco.ios.inventoryEntry","title":"The inventory, obtained by running `show inventory`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ip":{"name":"ip","type":"\u001bcisco.iosxe.ipConf","title":"The IPv4 configuration obtained by running `show running-config all | sec ip`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipConf":{"name":"ipConf","type":"\u001bcisco.iosxe.ipConf","title":"Cisco IOS XE IP services configuration","desc":"Global IP service settings parsed from `show running-config all | sec ip`, covering the embedded HTTP/HTTPS management server, its authentication and connection limits, IP source routing, and the source interfaces used for TFTP, RADIUS, and TACACS+ traffic. These controls decide whether the device exposes a web management plane and how tightly it is bounded, so they are prime hardening targets.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"keyChain":{"name":"keyChain","type":"\u001bcisco.iosxe.keyChain","title":"Cisco IOS XE authentication key chain","desc":"A key chain (`key chain \u003cname\u003e`) grouping one or more authentication keys, parsed from the running config. Key chains supply the rotating shared secrets used by routing protocols such as EIGRP and OSPF for neighbor authentication. The keys field exposes each key's secret, encoding, and validity windows; key chains with no keys are still listed.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"keychains":{"name":"keychains","type":"\u0019\u001bcisco.iosxe.keyChain","title":"The key chains configured on the device, obtained by running `show running-config | sec key chain`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logging":{"name":"logging","type":"\u001bcisco.iosxe.loggingConfiguration","title":"The logging configuration on the device.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loggingConfiguration":{"name":"loggingConfiguration","type":"\u001bcisco.iosxe.loggingConfiguration","title":"Cisco IOS XE logging configuration","desc":"System logging (syslog) configuration of the device, covering configuration-change logging, login success and failure logging, the local log buffer and its severity filter, and the remote syslog hosts and source interfaces. Collected from `show running-config all | include logging`. Use it to confirm that login events are logged and that logs are exported to remote syslog hosts.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ntp":{"name":"ntp","type":"\u001bcisco.iosxe.ntpConfiguration","title":"The NTP configuration on the device.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ntpConfiguration":{"name":"ntpConfiguration","type":"\u001bcisco.iosxe.ntpConfiguration","title":"Cisco IOS XE NTP configuration","desc":"Network Time Protocol settings parsed from `show running-config | include ntp`. Time synchronization is a security-relevant control: authenticated NTP prevents an attacker from skewing the device clock to invalidate certificate checks, replay-protection windows, and log timestamps. The authenticate field reports whether `ntp authenticate` is set, servers lists the configured time sources, and authenticationKeys / trustedKeys expose the key material and the trust list used to validate them. Audit with `cisco.iosxe.ntp.authenticate` and cross-check that every server has a keyId whose key also appears in trustedKeys.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"passwordEncryption":{"name":"passwordEncryption","type":"\u001bcisco.iosxe.passwordEncryption","title":"Cisco IOS XE password or secret encryption","desc":"A single stored credential from `enable password` or `enable secret`, capturing its encryption type and encoded value. The encryption type distinguishes reversible or weak encodings (cleartext, Vigenere, salted MD5) from modern hashes (PBKDF2, scrypt), making this the field to audit for weak enable credentials.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"routerEigrp":{"name":"routerEigrp","type":"\u0019\u001bcisco.iosxe.routerEigrpEntry","title":"The running config router EIGRP configurations obtained by running `show running-config all | sec router eigrp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerEigrpAddressFamily":{"name":"routerEigrpAddressFamily","type":"\u001bcisco.iosxe.routerEigrpAddressFamily","title":"Cisco IOS XE EIGRP address family","desc":"One address-family block within a named-mode EIGRP process, parsed from the running config. Identifies the protocol, cast type, VRF, and autonomous system number, and holds the per-interface settings (including authentication) under interfaces.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"routerEigrpAddressFamilyInterface":{"name":"routerEigrpAddressFamilyInterface","type":"\u001bcisco.iosxe.routerEigrpAddressFamilyInterface","title":"Cisco IOS XE EIGRP address-family interface","desc":"Per-interface EIGRP settings inside a named-mode address family (the `af-interface` block), parsed from the running config. The authentication mode and key chain fields determine whether EIGRP packets on this interface are cryptographically authenticated, making this the field to check when auditing EIGRP neighbor trust.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"routerEigrpEntry":{"name":"routerEigrpEntry","type":"\u001bcisco.iosxe.routerEigrpEntry","title":"Cisco IOS XE EIGRP process","desc":"An EIGRP routing process (`router eigrp \u003cname\u003e`) parsed from the running config in named mode, keyed on its process name. The address families field breaks the process out by protocol and VRF. EIGRP neighbor authentication is configured per address-family interface, so this resource is the entry point for auditing EIGRP routing security.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"routerOspf":{"name":"routerOspf","type":"\u0019\u001bcisco.iosxe.routerOspfEntry","title":"The running config router OSPF configuration obtained by running `show running-config all | sec router ospf`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerOspfEntry":{"name":"routerOspfEntry","type":"\u001bcisco.iosxe.routerOspfEntry","title":"Cisco IOS XE OSPF process","desc":"An OSPFv2 routing process (`router ospf \u003cprocess-id\u003e`) parsed from the running config, keyed on the process ID. The areas field exposes each configured area and its authentication settings. OSPF area authentication is a common audit target, so this resource anchors OSPF routing-security checks.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"serviceConfig":{"name":"serviceConfig","type":"\u001bcisco.iosxe.serviceConfig","title":"Cisco IOS XE service configuration","desc":"The `service ...` global options parsed from `show running-config all | include service`, several of which are hardening controls. Notably passwordEncryptionEnabled reflects `service password-encryption`, and the TCP keepalive flags help reap dead management sessions. logTimestampFormats captures how debug and log messages are timestamped.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"snmp":{"name":"snmp","type":"\u001bcisco.iosxe.snmpConfiguration","title":"The SNMP configuration on the device.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"snmpCommunity":{"name":"snmpCommunity","type":"\u001bcisco.iosxe.snmpCommunity","title":"Cisco IOS XE SNMP community string","desc":"An SNMP community, which for SNMPv1/v2c functions as a shared password granting read-only or read-write access to the device MIB. Because the string travels in cleartext, an RW community without an access-list is a serious exposure. Select with name and accessType and confirm aclId is set (for example `.communities.where(accessType == \"RW\")`).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"snmpConfiguration":{"name":"snmpConfiguration","type":"\u001bcisco.iosxe.snmpConfiguration","title":"Cisco IOS XE SNMP configuration","desc":"Simple Network Management Protocol settings gathered from a mix of `show snmp ...` and `show running-config | include snmp-server` commands. SNMP is a frequent attack surface: SNMPv1/v2c community strings are sent in cleartext and act as effective passwords, so auditing communities, access-lists, groups, and users is central to hardening. Check enabled first, then flag any RW community or any community without an acl.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ssh":{"name":"ssh","type":"\u001bcisco.iosxe.sshConfig","title":"SSH configuration obtained by running `show ip ssh`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sshConfig":{"name":"sshConfig","type":"\u001bcisco.iosxe.sshConfig","title":"SSH server configuration on a Cisco IOS XE device","desc":"SSH daemon settings parsed from `show ip ssh`. Reports whether SSH is enabled, the protocol version offered, the login timeout, the authentication-retry limit, and the Diffie-Hellman modulus size. These are common hardening targets, for example requiring SSH version 2, a low retry count, and a 2048-bit or larger modulus.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"timestampFormat":{"name":"timestampFormat","type":"\u001bcisco.iosxe.timestampFormat","title":"Cisco IOS XE timestamp format configuration","desc":"A single `service timestamps` directive, describing how one class of messages is timestamped. Accurate, dated timestamps (rather than uptime) are important for correlating logs across devices during an incident. The messageType field distinguishes the debug and log classes.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"user":{"name":"user","type":"\u001bcisco.iosxe.user","title":"Cisco IOS XE local user account","desc":"A locally defined user (`username ...`) parsed from the running config, with its privilege level and stored credential. Privilege level and credential encoding are the key audit points: level 15 grants full administrative access, and weak encoding types leave the credential recoverable.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bcisco.iosxe.user","title":"Usernames and privilege level and password information.","desc":"Obtained by running `show running-config | include username`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vtyLine":{"name":"vtyLine","type":"\u001bcisco.iosxe.vtyLine","title":"Cisco IOS XE virtual terminal line","desc":"Configuration of a VTY line range used for remote CLI access (Telnet and SSH), parsed from `show running-config all | sec vty`, including the inbound and outbound access-class ACLs, permitted input and output transports, EXEC timeout, and the login authentication method list. Useful for auditing remote-management exposure, for example restricting input transports to ssh and requiring an access-class. The startLine and endLine fields select the range.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"vtyLines":{"name":"vtyLines","type":"\u0019\u001bcisco.iosxe.vtyLine","title":"The VTY lines, obtained by running `show running-config | sec vty`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE network operating system","desc":"Configuration and operational state of a device running Cisco IOS XE, collected by running `show` commands over the device connection. Fields cover the hostname, domain names, interfaces and their configuration, SSH, CDP, DHCP, BOOTP, BGP, AAA, users and privilege levels, VTY/aux/console lines, access lists, key chains, SNMP, NTP, logging, RSA keys, and the global service and banner configuration. Use it to audit the security posture of an IOS XE router or switch.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.aaa":{"id":"cisco.iosxe.aaa","name":"cisco.iosxe.aaa","fields":{"accountingRecords":{"name":"accountingRecords","type":"\u0019\u001bcisco.iosxe.accountingEntry","title":"Accounting method lists, parsed from \"show running-config | include aaa accounting\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"enableEntries":{"name":"enableEntries","type":"\u0019\u001bcisco.iosxe.aaaAuthenticationEnableEntry","title":"Enable-password authentication method lists, parsed from \"show running-config | include aaa authentication enable\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loginEntries":{"name":"loginEntries","type":"\u0019\u001bcisco.iosxe.aaaAuthenticationLoginEntry","title":"Authentication login method lists, parsed from \"show running-config | include aaa authentication login\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"newModelEnabled":{"name":"newModelEnabled","type":"\u0004","title":"Whether \"aaa new-model\" is configured, enabling method-list-based AAA","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE AAA configuration","desc":"Authentication, Authorization, and Accounting settings parsed from the running configuration, including whether the AAA new model is enabled and the login authentication, enable authentication, and accounting method lists. Useful for verifying centralized AAA is enabled and management access is authenticated and accounted.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.aaaAuthentication":{"id":"cisco.iosxe.aaaAuthentication","fields":{"methodGroup":{"name":"methodGroup","type":"\u001bcisco.iosxe.aaaAuthentication.methodGroup","title":"Cisco IOS XE AAA authentication method token","desc":"A single method parsed from an authentication method list. Each token is either a reference to a server group or the local method; name holds the token and local flags the local case.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"cisco.iosxe.aaaAuthentication.methodGroup":{"id":"cisco.iosxe.aaaAuthentication.methodGroup","name":"cisco.iosxe.aaaAuthentication.methodGroup","fields":{"local":{"name":"local","type":"\u0004","is_mandatory":true,"title":"Whether this method is the local user database","desc":"True for the `local` (and `local-case`) method, which authenticates against locally configured usernames; false for group references and other keywords.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Method token name","desc":"The server-group name for a `group \u003cname\u003e` method (for example tacacs_example), or the literal method keyword otherwise (such as local, enable, or none).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE AAA authentication method token","desc":"A single method parsed from an authentication method list. Each token is either a reference to a server group or the local method; name holds the token and local flags the local case.","private":true,"defaults":"name local","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.aaaAuthenticationEnableEntry":{"id":"cisco.iosxe.aaaAuthenticationEnableEntry","name":"cisco.iosxe.aaaAuthenticationEnableEntry","fields":{"listName":{"name":"listName","type":"\u0007","is_mandatory":true,"title":"Named enable authentication method list","desc":"Name of the list (`default` applies unless a named list is attached).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methods":{"name":"methods","type":"\u0007","is_mandatory":true,"title":"Ordered authentication methods as a raw string","desc":"Space-separated methods tried in order, for example \"group tacacs+ enable\" or \"enable none\". Each method is attempted only if the previous one is unreachable. Use methodsGroups for the structured breakdown.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methodsGroups":{"name":"methodsGroups","type":"\u0019\u001bcisco.iosxe.aaaAuthentication.methodGroup","title":"Structured methods parsed from the methods string","desc":"One entry per method token, distinguishing server-group references from the local method.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE AAA enable authentication method list","desc":"A single `aaa authentication enable` line from the running-config, parsed from `show running-config | include aaa authentication enable`. Each entry defines the ordered methods used to authenticate elevation to privileged EXEC (enable) mode.","private":true,"defaults":"listName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.aaaAuthenticationLoginEntry":{"id":"cisco.iosxe.aaaAuthenticationLoginEntry","name":"cisco.iosxe.aaaAuthenticationLoginEntry","fields":{"listName":{"name":"listName","type":"\u0007","is_mandatory":true,"title":"Named login authentication method list","desc":"Name of the list (`default` applies to every line without an explicit list; named lists are attached per line with `login authentication`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methods":{"name":"methods","type":"\u0007","is_mandatory":true,"title":"Ordered authentication methods as a raw string","desc":"Space-separated methods tried in order, for example \"group tacacs+ local enable\" or \"local none\". Each method is attempted only if the previous one is unreachable. Use methodsGroups for the structured breakdown.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methodsGroups":{"name":"methodsGroups","type":"\u0019\u001bcisco.iosxe.aaaAuthentication.methodGroup","title":"Structured methods parsed from the methods string","desc":"One entry per method token, distinguishing server-group references from the local method.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE AAA login authentication method list","desc":"A single `aaa authentication login` line from the running-config, parsed from `show running-config | include aaa authentication login`. Each entry defines the ordered methods used to authenticate interactive login (console, vty, aux). Verifying that login lists use a remote server group before falling back to local, and never `none`, is a standard hardening check.","private":true,"defaults":"listName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.accessListEntry":{"id":"cisco.iosxe.accessListEntry","name":"cisco.iosxe.accessListEntry","fields":{"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"ACL name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"rule":{"name":"rule","type":"\u001bcisco.iosxe.accessListEntry.rule","title":"Cisco IOS XE IP access list entry","desc":"A single permit or deny rule within an access list, parsed from `show ip access-lists`. Captures the action, protocol, matched source and destination (as address plus Cisco wildcard mask, or an object group), and the line number that fixes its evaluation order. Rules are evaluated top-down and the first match wins, so priority and action together determine what traffic the ACL admits.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bcisco.iosxe.accessListEntry.rule","is_mandatory":true,"title":"Ordered permit and deny entries that make up this access list","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE IP access list","desc":"A named or numbered IP access list parsed from `show ip access-lists`, keyed on the acl name. The rules field holds the ordered permit/deny entries. Referenced from interface inbound/outbound bindings and SNMP community restrictions, so these lists define much of the device's packet- and management-plane filtering.","private":true,"defaults":"acl","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.accessListEntry.rule":{"id":"cisco.iosxe.accessListEntry.rule","name":"cisco.iosxe.accessListEntry.rule","fields":{"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"Name of the access list this rule belongs to","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action taken on a match, either `permit` or `deny`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"destinationAddress":{"name":"destinationAddress","type":"\u000f","is_mandatory":true,"title":"Destination address","desc":"Destination IP the rule matches, following the same host/any encoding as sourceAddress. Null when the destination is a network object group.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"destinationNetworkObjectGroup":{"name":"destinationNetworkObjectGroup","type":"\u0007","is_mandatory":true,"title":"Name of the destination network object group when the rule matches by group instead of address/mask","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"destinationWildcardMask":{"name":"destinationWildcardMask","type":"\u000f","is_mandatory":true,"title":"Destination wildcard mask","desc":"Cisco inverse (wildcard) mask paired with destinationAddress. Null when an object group is used.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Line number that sets this rule's position in the top-down evaluation order","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Matched protocol, such as `ip`, `tcp`, `udp`, or `icmp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceAddress":{"name":"sourceAddress","type":"\u000f","is_mandatory":true,"title":"Source address","desc":"Source IP the rule matches. For a `host` clause this is that host's address; for `any` it is `0.0.0.0`. Null when the source is expressed as a network object group instead.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceNetworkObjectGroup":{"name":"sourceNetworkObjectGroup","type":"\u0007","is_mandatory":true,"title":"Name of the source network object group when the rule matches by group instead of address/mask","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceWildcardMask":{"name":"sourceWildcardMask","type":"\u000f","is_mandatory":true,"title":"Source wildcard mask","desc":"Cisco inverse (wildcard) mask paired with sourceAddress, where a `0` bit requires an exact match and a `1` bit is a wildcard. `0.0.0.0` for a single host and `255.255.255.255` for `any`. Null when an object group is used.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE IP access list entry","desc":"A single permit or deny rule within an access list, parsed from `show ip access-lists`. Captures the action, protocol, matched source and destination (as address plus Cisco wildcard mask, or an object group), and the line number that fixes its evaluation order. Rules are evaluated top-down and the first match wins, so priority and action together determine what traffic the ACL admits.","private":true,"defaults":"sourceAddress action priority","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.accounting":{"id":"cisco.iosxe.accounting","fields":{"server":{"name":"server","type":"\u001bcisco.iosxe.accounting.server","title":"Cisco IOS XE AAA accounting target","desc":"A single destination that accounting records are sent to, derived from the parent entry's method tokens. The name field holds the target as it appears in the config; isGroup reports whether it names a server group.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"cisco.iosxe.accounting.server":{"id":"cisco.iosxe.accounting.server","name":"cisco.iosxe.accounting.server","fields":{"isGroup":{"name":"isGroup","type":"\u0004","title":"Whether this target references a server group","desc":"True when name contains the `group` keyword (a built-in or custom server group), false for bare method keywords such as none.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Accounting target as written in the running-config","desc":"Either a built-in group reference such as `group radius` or `group tacacs+`, a custom `group \u003cname\u003e` referencing a named server group, or a bare method keyword such as none.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE AAA accounting target","desc":"A single destination that accounting records are sent to, derived from the parent entry's method tokens. The name field holds the target as it appears in the config; isGroup reports whether it names a server group.","private":true,"defaults":"name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.accountingEntry":{"id":"cisco.iosxe.accountingEntry","name":"cisco.iosxe.accountingEntry","fields":{"accountingType":{"name":"accountingType","type":"\u0007","is_mandatory":true,"title":"When accounting records are generated","desc":"start-stop sends a start record at the beginning of a process and a stop record at the end (the start is sent without waiting), stop-only sends only a stop record at the end, and none disables accounting for the line or interface. Empty when the running-config omits the keyword.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"broadcast":{"name":"broadcast","type":"\u0004","is_mandatory":true,"title":"Whether accounting records are broadcast to multiple AAA server groups","desc":"True when the `broadcast` keyword is set, which sends each accounting record simultaneously to all configured server groups rather than failing over between them.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methodList":{"name":"methodList","type":"\u0007","is_mandatory":true,"title":"Named accounting method list","desc":"Name applied by this entry (`default` is the list applied to all lines and interfaces unless a named list is explicitly attached). Custom names are referenced by line or interface configuration.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"privilegeLevel":{"name":"privilegeLevel","type":"\u0005","is_mandatory":true,"title":"Privilege level of the commands being accounted","desc":"Level in the range 0 to 15 whose commands are recorded, from `aaa accounting commands \u003clevel\u003e`. Level 15 is full privileged (enable) access. Only meaningful when type is commands; null otherwise.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"serverMethods":{"name":"serverMethods","type":"\u0007","is_mandatory":true,"title":"Raw method/target tokens following the record type","desc":"Unparsed remainder of the accounting line, for example \"group tacacs+ group radius\" or \"group MYGROUP none\". Use servers for the structured breakdown of each target.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"servers":{"name":"servers","type":"\u0019\u001bcisco.iosxe.accounting.server","title":"Structured accounting targets parsed from serverMethods","desc":"One entry per method token where records are sent, for example a built-in group such as `group radius` / `group tacacs+`, a custom `group \u003cname\u003e`, or a keyword such as none.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Activity being accounted","desc":"One of auth-proxy, system, network, exec, connection, commands, or dot1x. exec accounts EXEC (shell) sessions, commands accounts CLI commands at a given privilege level, network accounts network-service requests (PPP, SLIP, ARAP), connection accounts outbound connections (telnet, ssh, rlogin), system accounts system-level events, dot1x accounts 802.1X sessions, and auth-proxy accounts authentication-proxy events.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"Optional VRF the system accounting records are associated with","desc":"VRF name from `aaa accounting system default vrf \u003cname\u003e`. Empty when no VRF is specified. Applies to type system.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE AAA accounting method definition","desc":"A single `aaa accounting` line from the running-config, parsed from `show running-config | include aaa accounting`. Each entry records what activity is audited (type), which named method list applies, when records are emitted, and where they are sent. Accounting coverage of exec sessions and level-15 commands is a common compliance requirement.","private":true,"defaults":"type methodList","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.auxLineEntry":{"id":"cisco.iosxe.auxLineEntry","name":"cisco.iosxe.auxLineEntry","fields":{"exec":{"name":"exec","type":"\u0004","is_mandatory":true,"title":"Whether an interactive EXEC session is permitted on the aux line","desc":"True when the EXEC process is enabled (either explicitly with `exec` or by default, since EXEC is on unless disabled). False when `no exec` is configured, which restricts the line to outgoing connections only (for example reverse telnet) and blocks interactive login. Disabling EXEC on an unused aux port is a common hardening recommendation.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"execTimeout":{"name":"execTimeout","type":"\t","is_mandatory":true,"title":"Idle EXEC timeout for the aux line","desc":"Duration of inactivity after which the session is closed, from the `exec-timeout \u003cmin\u003e \u003csec\u003e` command (default 10 minutes). Null when no exec-timeout is configured. A value of zero (`exec-timeout 0 0`) disables the timeout entirely, leaving sessions open indefinitely.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"privilegeLevel":{"name":"privilegeLevel","type":"\u0005","is_mandatory":true,"title":"Default privilege level assigned to sessions on the aux line","desc":"Level in the range 0 to 15 that a user is placed in on connecting, set with `privilege level`. Level 1 is normal user EXEC, level 15 is full privileged (enable) access. A line hardcoded to level 15 grants enable rights without a further password and is a finding.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE auxiliary (aux) line configuration","desc":"Console-equivalent settings for the auxiliary port (line aux 0), parsed from `show running-config all | sec line aux 0`. Because the aux port often has a modem attached and is a classic backdoor into a device, auditing its exec, privilege level, and idle timeout matters. The exec field reports whether an interactive EXEC session is allowed, privilegeLevel the level assigned on connect, and execTimeout the idle disconnect window.","private":true,"defaults":"exec execTimeout","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.bgpConfig":{"id":"cisco.iosxe.bgpConfig","name":"cisco.iosxe.bgpConfig","fields":{"asNumber":{"name":"asNumber","type":"\u0005","is_mandatory":true,"title":"Local BGP autonomous system (AS) number the device runs under","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"neighbor":{"name":"neighbor","type":"\u001bcisco.iosxe.bgpConfig.neighbor","title":"BGP neighbor on a Cisco IOS XE device","desc":"A single configured BGP peer or peer group, keyed by its identifier. Reports the peer address or peer-group name, whether it is a peer group, its remote AS, description, MD5 password, and the update-source interface. Use this to audit peer-level security such as MD5 authentication and correct remote-AS assignment.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"neighbors":{"name":"neighbors","type":"\u0019\u001bcisco.iosxe.bgpConfig.neighbor","is_mandatory":true,"title":"Configured BGP neighbors and peer groups","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"BGP routing configuration on a Cisco IOS XE device","desc":"Border Gateway Protocol settings parsed from `show running-config all | sec router bgp`: the local autonomous system number and the configured neighbors. Traverse neighbors to audit peer authentication and remote-AS assignment, for example `.bgp.neighbors.all(password != \"\")` to require MD5 authentication on every peer.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.bgpConfig.neighbor":{"id":"cisco.iosxe.bgpConfig.neighbor","name":"cisco.iosxe.bgpConfig.neighbor","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the BGP neighbor configured with `neighbor \u003cid\u003e description`, or empty when none is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Neighbor identifier, either an IPv4 or IPv6 peer address or the name of a peer group","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ip":{"name":"ip","type":"\u000f","title":"Peer IP address when id is an address","desc":"Parsed IP form of id. Null when the neighbor is a peer group or id is not an IP address.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"isPeerGroup":{"name":"isPeerGroup","type":"\u0004","is_mandatory":true,"title":"Whether this entry is a peer group rather than an individual neighbor address","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"password":{"name":"password","type":"\u0007","is_mandatory":true,"title":"MD5 authentication password configured with `neighbor \u003cid\u003e password`, enabling TCP MD5 signature protection for the session","desc":"empty when no password is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"remoteAsNumber":{"name":"remoteAsNumber","type":"\u0005","is_mandatory":true,"title":"Remote autonomous system number of the neighbor","desc":"AS number the peer belongs to, configured with `neighbor \u003cid\u003e remote-as`. Valid values span 1 to 4294967295 (2-byte ASNs 1 to 65535 and 4-byte ASNs beyond that). Null when no remote AS is configured (for example on a peer-group template).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"updateSourceInterface":{"name":"updateSourceInterface","type":"\u001bcisco.iosxe.interface","title":"Interface used to source BGP TCP connections to the neighbor","desc":"Resolves updateSourceInterfaceName to the matching cisco.iosxe.interface. Null when no update-source is configured or the interface cannot be found.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"updateSourceInterfaceName":{"name":"updateSourceInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the interface whose address BGP uses to source TCP connections to the neighbor (`neighbor \u003cid\u003e update-source`), or empty when not set","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"BGP neighbor on a Cisco IOS XE device","desc":"A single configured BGP peer or peer group, keyed by its identifier. Reports the peer address or peer-group name, whether it is a peer group, its remote AS, description, MD5 password, and the update-source interface. Use this to audit peer-level security such as MD5 authentication and correct remote-AS assignment.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.bootpConfig":{"id":"cisco.iosxe.bootpConfig","name":"cisco.iosxe.bootpConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the BOOTP service is enabled (false when `ip dhcp bootp ignore` is present in the running-config)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"BOOTP service configuration on a Cisco IOS XE device","desc":"BOOTP server state derived from `show running-config all | include bootp`. The legacy BOOTP service is often disabled with `ip dhcp bootp ignore` as a hardening step. Audit with `.bootp.enabled == false`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.cdpConfig":{"id":"cisco.iosxe.cdpConfig","name":"cisco.iosxe.cdpConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether CDP is enabled globally (false when the device reports \"CDP is not enabled\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"CDP configuration on a Cisco IOS XE device","desc":"Global Cisco Discovery Protocol state parsed from `show cdp`. CDP advertises device identity, IOS version, and addressing to directly connected Cisco neighbors and is frequently disabled on untrusted or edge interfaces to limit information disclosure. Audit with `.cdp.enabled == false`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.config":{"id":"cisco.iosxe.config","name":"cisco.iosxe.config","fields":{"enablePassword":{"name":"enablePassword","type":"\u001bcisco.iosxe.passwordEncryption","title":"Enable password credential","desc":"The `enable password` entry from `show running-config | include enable password`, with its encoding type and value. The enable password uses weak (reversible) encoding; prefer enableSecret. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"enableSecret":{"name":"enableSecret","type":"\u001bcisco.iosxe.passwordEncryption","title":"Enable secret credential","desc":"The `enable secret` entry from `show running-config | include enable secret`, with its hash type and value. Unlike enablePassword, the secret is stored as a one-way hash. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"execBanner":{"name":"execBanner","type":"\u0007","title":"Exec banner text","desc":"Text of the `banner exec` message, shown after a user authenticates and an EXEC session starts, from `show running-config | beg banner exec`. Empty when no exec banner is set.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loginBanner":{"name":"loginBanner","type":"\u0007","title":"Login banner text shown before the login prompt, from `show running-config |","desc":"beg banner login`. Empty when no login banner is set.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"motdBanner":{"name":"motdBanner","type":"\u0007","title":"Message-of-the-day banner text shown to all users when they connect, from","desc":"`show running-config | beg banner motd`. Empty when no MOTD banner is set.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"service":{"name":"service","type":"\u001bcisco.iosxe.serviceConfig","title":"Service configuration settings","desc":"The `service ...` options parsed from `show running-config all | include service`, including password encryption, TCP keepalives, PAD, and log timestamp formats.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE global configuration settings","desc":"Assorted device-wide configuration relevant to hardening: the `service` options, the enable password and secret credentials, and the exec, MOTD, and login banners. Each field runs a targeted `show running-config` filter. Use it to confirm that a strong enable secret is set (rather than a reversible enable password) and that required legal banners are present.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.consoleLineEntry":{"id":"cisco.iosxe.consoleLineEntry","name":"cisco.iosxe.consoleLineEntry","fields":{"exec":{"name":"exec","type":"\u0004","is_mandatory":true,"title":"Whether an interactive EXEC session is permitted on the console line","desc":"True when the EXEC process is enabled (either explicitly with `exec` or by default, since EXEC is on unless disabled). False when `no exec` is configured, which restricts the line to outgoing connections only and blocks interactive login at the console.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"execTimeout":{"name":"execTimeout","type":"\t","is_mandatory":true,"title":"Idle EXEC timeout for the console line","desc":"Duration of inactivity after which the session is closed, from the `exec-timeout \u003cmin\u003e \u003csec\u003e` command (default 10 minutes). Null when no exec-timeout is configured. A value of zero (`exec-timeout 0 0`) disables the timeout, leaving a logged-in console open indefinitely.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"privilegeLevel":{"name":"privilegeLevel","type":"\u0005","is_mandatory":true,"title":"Default privilege level assigned to sessions on the console line","desc":"Level in the range 0 to 15 that a user is placed in on connecting, set with `privilege level`. Level 1 is normal user EXEC, level 15 is full privileged (enable) access. Hardcoding the console to level 15 bypasses enable authentication and is a finding.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE console (con) line configuration","desc":"Settings for the local console port (line con 0), parsed from `show running-config all | sec line con 0`. The console is the physical management port, so its exec state, privilege level, and idle timeout are core hardening controls. The exec field reports whether an interactive EXEC session is allowed, privilegeLevel the level assigned on connect, and execTimeout the idle disconnect window.","private":true,"defaults":"exec execTimeout","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.cryptoKeyRsa":{"id":"cisco.iosxe.cryptoKeyRsa","name":"cisco.iosxe.cryptoKeyRsa","fields":{"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Timestamp when the key pair was generated on the device","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyData":{"name":"keyData","type":"\u0019\u0007","is_mandatory":true,"title":"Raw hexadecimal public key material, as printed line by line by the device","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyType":{"name":"keyType","type":"\u0007","is_mandatory":true,"title":"Key type reported by the device (for example \"RSA\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Key pair label, typically the device's \u003chostname\u003e.\u003cdomain\u003e name or a name given at key generation","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"modulusSize":{"name":"modulusSize","type":"\u0005","title":"RSA modulus size in bits, computed by parsing the public key material (for example 1024, 2048, or 4096); larger is stronger","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"usage":{"name":"usage","type":"\u0007","is_mandatory":true,"title":"Declared usage of the key (for example \"General Purpose Key\", \"Signature Key\", or \"Encryption Key\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"RSA public key on a Cisco IOS XE device","desc":"An RSA key pair's public component parsed from `show crypto key mypubkey rsa`, selectable by label. Reports the key's label, type, usage, creation time, computed modulus size, and the raw public key material. The modulus size is the primary hardening signal: audit with `.cryptoKeysRsa.all(modulusSize \u003e= 2048)` to require adequately sized keys for SSH and PKI.","private":true,"defaults":"label keyType modulusSize","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.dhcpConfig":{"id":"cisco.iosxe.dhcpConfig","name":"cisco.iosxe.dhcpConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the DHCP service is enabled (false when `no service dhcp` is present in the running-config)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"DHCP service configuration on a Cisco IOS XE device","desc":"DHCP service state derived from `show running-config all | include dhcp`. The on-device DHCP service is disabled with `no service dhcp`, which is a common hardening measure on devices that should not hand out addresses. Audit with `.dhcp.enabled == false`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.domainName":{"id":"cisco.iosxe.domainName","name":"cisco.iosxe.domainName","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Default domain name appended to unqualified host names (for example","desc":"`example.com`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrfName":{"name":"vrfName","type":"\u0007","is_mandatory":true,"title":"VRF this domain name applies to","desc":"Virtual Routing and Forwarding instance named in the `vrf` keyword of the `ip domain name` statement, scoping the domain to queries in that VRF. Empty when it applies to the global routing table.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE default domain name","desc":"An `ip domain name` statement, giving the default domain appended to unqualified host names during DNS resolution. Parsed from `show running-config | include domain name`. Multiple entries can exist when per-VRF domain names are configured; vrfName distinguishes them.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.interface":{"id":"cisco.iosxe.interface","name":"cisco.iosxe.interface","fields":{"abort":{"name":"abort","type":"\u0007","is_mandatory":true,"title":"Number of received packets aborted mid-frame, typically due to a collision or line error","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bandwidth":{"name":"bandwidth","type":"\u0007","is_mandatory":true,"title":"Configured interface bandwidth in kilobits per second, used as a routing-metric input","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bia":{"name":"bia","type":"\u0007","is_mandatory":true,"title":"Burned-in (factory) hardware MAC address of the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"config":{"name":"config","type":"\u001bcisco.iosxe.interfaceConfig","title":"Interface-level running-config settings, such as ACLs, proxy ARP, uRPF, and routing-protocol authentication","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"crc":{"name":"crc","type":"\u0007","is_mandatory":true,"title":"Number of inbound packets that failed the CRC check, often indicating noise, cabling, or duplex issues","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form interface description configured with the `description` command, or empty when none is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"duplex":{"name":"duplex","type":"\u0007","is_mandatory":true,"title":"Duplex setting, such as \"Full\" or \"Half\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encapsulation":{"name":"encapsulation","type":"\u0007","is_mandatory":true,"title":"Layer 2 encapsulation in use (for example \"ARPA\" or \"802.1Q Virtual LAN\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"frame":{"name":"frame","type":"\u0007","is_mandatory":true,"title":"Number of inbound packets with a framing (non-integer byte count) error","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"giants":{"name":"giants","type":"\u0007","is_mandatory":true,"title":"Number of received packets discarded for exceeding the maximum frame size (giants)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hardwareType":{"name":"hardwareType","type":"\u0007","is_mandatory":true,"title":"Hardware type of the interface (for example \"iGbE\", \"Ethernet\", or \"VLAN\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputErrors":{"name":"inputErrors","type":"\u0007","is_mandatory":true,"title":"Total number of inbound packets with errors (a superset of CRC, frame, overrun, and runt errors)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputPackets":{"name":"inputPackets","type":"\u0007","is_mandatory":true,"title":"Total number of packets received on the interface since the counters were last cleared","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputPps":{"name":"inputPps","type":"\u0007","is_mandatory":true,"title":"Input packet rate over the load interval, in packets per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputRate":{"name":"inputRate","type":"\u0007","is_mandatory":true,"title":"Input traffic rate over the load interval, in bits per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"Primary IPv4 address with prefix length or mask (for example \"10.0.0.1/24\"), or empty when unnumbered or unassigned","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lastInput":{"name":"lastInput","type":"\u0007","is_mandatory":true,"title":"Elapsed time since the interface last received a packet (for example \"00:00:01\" or \"never\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lastOutput":{"name":"lastOutput","type":"\u0007","is_mandatory":true,"title":"Elapsed time since the interface last sent a packet (for example \"00:00:01\" or \"never\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"linkStatus":{"name":"linkStatus","type":"\u0007","is_mandatory":true,"title":"Combined line and line-protocol status, such as \"up\" or \"administratively down\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"macAddress":{"name":"macAddress","type":"\u0007","is_mandatory":true,"title":"Currently configured MAC address of the interface, in dotted-hex notation","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"mediaType":{"name":"mediaType","type":"\u0007","is_mandatory":true,"title":"Physical media type of the interface (for example \"10/100/1000BaseTX\" or \"SFP\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"mtu":{"name":"mtu","type":"\u0007","is_mandatory":true,"title":"Maximum transmission unit in bytes, as reported by the device","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name, as reported by the device (for example \"GigabitEthernet0/0\" or \"Vlan1\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputErrors":{"name":"outputErrors","type":"\u0007","is_mandatory":true,"title":"Total number of outbound packets that could not be sent because of errors","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputPackets":{"name":"outputPackets","type":"\u0007","is_mandatory":true,"title":"Total number of packets sent on the interface since the counters were last cleared","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputPps":{"name":"outputPps","type":"\u0007","is_mandatory":true,"title":"Output packet rate over the load interval, in packets per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputRate":{"name":"outputRate","type":"\u0007","is_mandatory":true,"title":"Output traffic rate over the load interval, in bits per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"overrun":{"name":"overrun","type":"\u0007","is_mandatory":true,"title":"Number of times the receiver hardware could not hand received data to a buffer because the input rate exceeded its capacity","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runts":{"name":"runts","type":"\u0007","is_mandatory":true,"title":"Number of received packets discarded for being smaller than the minimum frame size (runts)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"speed":{"name":"speed","type":"\u0007","is_mandatory":true,"title":"Negotiated or configured line rate (for example \"1000Mb/s\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vlanId":{"name":"vlanId","type":"\u0007","is_mandatory":true,"title":"VLAN ID for a subinterface or SVI, or empty when the interface is not VLAN-tagged","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Network interface on a Cisco IOS XE device","desc":"Operational interface state parsed from `show interfaces`, keyed by interface name. Reports link and protocol status, addressing, speed and duplex, and the running counters (packets, bit and packet rates, and error tallies such as CRC, runts, and giants) for each interface. Select an interface with `.interfaces.where(name == \"GigabitEthernet0/0\")`, and use config to reach the interface's running-config settings.","private":true,"defaults":"name linkStatus","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.interfaceConfig":{"id":"cisco.iosxe.interfaceConfig","name":"cisco.iosxe.interfaceConfig","fields":{"aclInbound":{"name":"aclInbound","type":"\u001bcisco.iosxe.accessListEntry","title":"Access-list entry applied to inbound traffic on the interface","desc":"Resolves aclInboundName to the matching cisco.iosxe.accessListEntry so the ACL's rules can be traversed directly. Null when no inbound ACL is applied or the named ACL cannot be found.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aclInboundName":{"name":"aclInboundName","type":"\u0007","is_mandatory":true,"title":"Name of the access list applied to inbound traffic with `ip access-group \u003cname\u003e in`, or empty when no inbound ACL is applied","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aclOutbound":{"name":"aclOutbound","type":"\u001bcisco.iosxe.accessListEntry","title":"Access-list entry applied to outbound traffic on the interface","desc":"Resolves aclOutboundName to the matching cisco.iosxe.accessListEntry so the ACL's rules can be traversed directly. Null when no outbound ACL is applied or the named ACL cannot be found.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aclOutboundName":{"name":"aclOutboundName","type":"\u0007","is_mandatory":true,"title":"Name of the access list applied to outbound traffic with `ip access-group \u003cname\u003e out`, or empty when no outbound ACL is applied","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"eigrpConfig":{"name":"eigrpConfig","type":"\u001bcisco.iosxe.interfaceConfig.eigrpConfig","title":"EIGRP authentication settings bound to a Cisco IOS XE interface","desc":"Per-interface EIGRP settings parsed from the interface running-config, one entry for each EIGRP autonomous system referenced on the interface. Reports whether MD5 authentication is enabled for the adjacency and which key chain supplies the authentication keys, letting an audit confirm that EIGRP neighbors on an interface are cryptographically authenticated.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ipEigrpConfig":{"name":"ipEigrpConfig","type":"\u0019\u001bcisco.iosxe.interfaceConfig.eigrpConfig","is_mandatory":true,"title":"EIGRP authentication settings bound to the interface, one entry per EIGRP autonomous system configured on it","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name the configuration applies to, as it appears in the running-config (for example \"GigabitEthernet0/0\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ospfConfig":{"name":"ospfConfig","type":"\u001bcisco.iosxe.interfaceConfig.ospfConfig","is_mandatory":true,"title":"OSPF settings bound to the interface, including process and area assignment and authentication","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"proxyArpEnabled":{"name":"proxyArpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether proxy ARP is enabled on the interface","desc":"True when `ip proxy-arp` is present. Proxy ARP lets the router answer ARP requests on behalf of hosts on other subnets and is commonly disabled as a hardening measure, so this is a frequent audit target.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"urpf":{"name":"urpf","type":"\u001bcisco.iosxe.interfaceConfig.urpf","is_mandatory":true,"title":"Unicast reverse path forwarding (uRPF) settings on the interface, used to drop packets with spoofed source addresses","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Per-interface configuration on a Cisco IOS XE device","desc":"Interface-level settings parsed from `show running-config all | sec interface`, keyed by the interface name. Covers the security-relevant running-config of each interface: proxy ARP state, inbound and outbound access lists, unicast reverse path forwarding, and the EIGRP and OSPF routing-protocol settings bound to the interface. Select an interface with `.interfaceConfigs.where(name == \"GigabitEthernet0/0\")` to audit hardening such as proxy ARP being disabled or an ingress ACL being applied.","private":true,"defaults":"name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.interfaceConfig.eigrpConfig":{"id":"cisco.iosxe.interfaceConfig.eigrpConfig","name":"cisco.iosxe.interfaceConfig.eigrpConfig","fields":{"eigrpNumber":{"name":"eigrpNumber","type":"\u0007","is_mandatory":true,"title":"EIGRP autonomous system number, or the process name in EIGRP named mode, that this interface configuration applies to","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keychain":{"name":"keychain","type":"\u001bcisco.iosxe.keyChain","title":"Key chain on this device that keychainName refers to","desc":"Resolves keychainName to the matching cisco.iosxe.keyChain so the key strings, key IDs, and accept/send lifetimes can be inspected. Null when no key chain is configured or the named chain cannot be found.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keychainName":{"name":"keychainName","type":"\u0007","is_mandatory":true,"title":"Name of the key chain supplying EIGRP authentication keys on the interface, or empty when none is configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationMode":{"name":"md5AuthenticationMode","type":"\u0004","is_mandatory":true,"title":"Whether MD5 authentication mode is enabled for EIGRP on the interface","desc":"True when `ip authentication mode eigrp \u003cas\u003e md5` is configured for the autonomous system, enabling keyed-MD5 authentication of EIGRP packets.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerEigrp":{"name":"routerEigrp","type":"\u001bcisco.iosxe.routerEigrpEntry","title":"Router EIGRP process on this device that matches eigrpNumber","desc":"Resolves to the cisco.iosxe.routerEigrpEntry whose name equals eigrpNumber, linking the interface settings to the global EIGRP process. Null when no matching process exists.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"EIGRP authentication settings bound to a Cisco IOS XE interface","desc":"Per-interface EIGRP settings parsed from the interface running-config, one entry for each EIGRP autonomous system referenced on the interface. Reports whether MD5 authentication is enabled for the adjacency and which key chain supplies the authentication keys, letting an audit confirm that EIGRP neighbors on an interface are cryptographically authenticated.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.interfaceConfig.ospfConfig":{"id":"cisco.iosxe.interfaceConfig.ospfConfig","name":"cisco.iosxe.interfaceConfig.ospfConfig","fields":{"areaId":{"name":"areaId","type":"\u0007","is_mandatory":true,"title":"OSPF area the interface belongs to, as configured on the interface, or empty when not set at the interface level","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authenticationEnabled":{"name":"authenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether OSPF authentication is enabled on the interface","desc":"False when `ip ospf authentication null` is configured, which explicitly disables OSPF authentication on the interface. This setting overrides authentication settings at the area level.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keychain":{"name":"keychain","type":"\u001bcisco.iosxe.keyChain","title":"Key chain on this device that keychainName refers to","desc":"Resolves keychainName to the matching cisco.iosxe.keyChain. Null when no key chain is configured or the named chain cannot be found.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keychainName":{"name":"keychainName","type":"\u0007","is_mandatory":true,"title":"Name of the key chain supplying OSPF authentication keys on the interface, or empty when none is configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationEnabled":{"name":"md5AuthenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether OSPF MD5 message-digest authentication is enabled on the interface","desc":"True when `ip ospf authentication message-digest` is configured on the interface, forcing cryptographic authentication of OSPF packets over the weaker plaintext password scheme.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"messageDigestKey":{"name":"messageDigestKey","type":"\u001bcisco.iosxe.interfaceConfig.ospfConfig.messageDigestKey","title":"OSPF MD5 message-digest key on a Cisco IOS XE interface","desc":"A single keyed-MD5 authentication key configured with `ip ospf message-digest-key \u003cid\u003e md5 [0|7] \u003ckey\u003e`. Exposes the key ID that peers must agree on, whether the stored key string is encrypted, and the key material itself, so an audit can flag interfaces whose OSPF keys are stored in cleartext.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"messageDigestKeys":{"name":"messageDigestKeys","type":"\u0019\u001bcisco.iosxe.interfaceConfig.ospfConfig.messageDigestKey","is_mandatory":true,"title":"OSPF MD5 message-digest keys configured on the interface with `ip ospf message-digest-key`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ospfArea":{"name":"ospfArea","type":"\u001bcisco.iosxe.routerOspfEntry.area","title":"OSPF area on the matching process that corresponds to areaId","desc":"Resolves to the cisco.iosxe.routerOspfEntry.area with the matching area ID within the interface's OSPF process. Null when the process or area cannot be resolved.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ospfEntry":{"name":"ospfEntry","type":"\u001bcisco.iosxe.routerOspfEntry","title":"Router OSPF process on this device that matches processId","desc":"Resolves to the cisco.iosxe.routerOspfEntry whose process ID equals processId. Null when no matching process is found.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"processId":{"name":"processId","type":"\u0007","is_mandatory":true,"title":"OSPF process ID the interface is assigned to via `ip ospf \u003cprocess-id\u003e area \u003carea\u003e`, or empty when only network-statement-based assignment is used","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"OSPF settings bound to a Cisco IOS XE interface","desc":"Per-interface OSPF settings parsed from the interface running-config: the process and area the interface participates in and the authentication applied to its adjacencies. Interface-level authentication overrides the area-level setting, so this is where per-link OSPF authentication is confirmed, for example `.ospfConfig { md5AuthenticationEnabled }`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.interfaceConfig.ospfConfig.messageDigestKey":{"id":"cisco.iosxe.interfaceConfig.ospfConfig.messageDigestKey","name":"cisco.iosxe.interfaceConfig.ospfConfig.messageDigestKey","fields":{"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Encryption level of the stored key string","desc":"0 means the key string that follows is entered and stored in cleartext; 7 means it is obscured with Cisco's proprietary (reversible, weak) type-7 encryption. Present as a string to preserve the raw token from the running-config.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Message-digest key ID, in the range 1 to 255, that must match on both OSPF neighbors","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyString":{"name":"keyString","type":"\u0007","is_mandatory":true,"title":"Key string value used to compute the MD5 digest, either cleartext or type-7 obscured depending on encryptionType","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"OSPF MD5 message-digest key on a Cisco IOS XE interface","desc":"A single keyed-MD5 authentication key configured with `ip ospf message-digest-key \u003cid\u003e md5 [0|7] \u003ckey\u003e`. Exposes the key ID that peers must agree on, whether the stored key string is encrypted, and the key material itself, so an audit can flag interfaces whose OSPF keys are stored in cleartext.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.interfaceConfig.urpf":{"id":"cisco.iosxe.interfaceConfig.urpf","name":"cisco.iosxe.interfaceConfig.urpf","fields":{"allowDefault":{"name":"allowDefault","type":"\u0004","is_mandatory":true,"title":"Whether the default route may satisfy the source check","desc":"True when the `allow-default` option is set, letting a source that only matches the default route (0.0.0.0/0) pass verification. This significantly weakens uRPF because almost any source becomes reachable via the default route.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"allowSelfPing":{"name":"allowSelfPing","type":"\u0004","is_mandatory":true,"title":"Whether the router is allowed to ping its own interfaces through uRPF","desc":"True when the `allow-self-ping` option is set. Use caution when enabling this setting because it opens a denial-of-service (DoS) hole.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether uRPF is enabled on the interface (true when a `reachable-via` mode is configured)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"uRPF verification mode","desc":"\"rx\" for strict mode, where the packet must arrive on the same interface the router would use to reach the source; \"any\" for loose mode, where the source only needs a route in the table via any interface. Empty when uRPF is disabled. Strict mode gives stronger anti-spoofing but can drop legitimate asymmetrically routed traffic.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceBindingEnabled":{"name":"sourceBindingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Layer 2 source address binding is enforced","desc":"True when the `l2-src` option is set, which additionally checks that the packet's source IP and source MAC address match a valid binding, extending the anti-spoofing check to Layer 2.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Unicast reverse path forwarding (uRPF) settings on a Cisco IOS XE interface","desc":"Anti-spoofing state configured with `ip verify unicast source reachable-via`. uRPF validates the source address of incoming packets against the routing table and drops packets whose source is unreachable, mitigating source-address spoofing. Exposes whether uRPF is on, whether it runs in strict or loose mode, and the optional modifiers that loosen the check. Audit with `.urpf { enabled mode == \"rx\" }` to require strict-mode uRPF.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.ipConf":{"id":"cisco.iosxe.ipConf","name":"cisco.iosxe.ipConf","fields":{"connectionIdleDuration":{"name":"connectionIdleDuration","type":"\t","is_mandatory":true,"title":"Idle timeout applied to an HTTP connection with no activity (`ip http timeout-policy idle`), if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"connectionLifetimeDuration":{"name":"connectionLifetimeDuration","type":"\t","is_mandatory":true,"title":"Maximum total lifetime an HTTP connection is kept open (`ip http timeout-policy life`), if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"connectionLingerDuration":{"name":"connectionLingerDuration","type":"\t","is_mandatory":true,"title":"Duration an HTTP connection lingers open after the final response is sent, if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"connectionMaxRequests":{"name":"connectionMaxRequests","type":"\u0005","is_mandatory":true,"title":"Maximum number of requests an HTTP connection may serve before it is closed (`ip http timeout-policy requests`), if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"httpAuthenticationMethod":{"name":"httpAuthenticationMethod","type":"\u0007","is_mandatory":true,"title":"HTTP server authentication method","desc":"Method used to authenticate web sessions (`ip http authentication`), such as `aaa`, `local`, `enable`, or `tacacs`. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"httpEnabled":{"name":"httpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the embedded HTTP management server is enabled (`ip http server`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"httpPort":{"name":"httpPort","type":"\u0005","is_mandatory":true,"title":"TCP port the HTTP server listens on, when a non-default port is configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"httpWebAuthBanner":{"name":"httpWebAuthBanner","type":"\u0007","is_mandatory":true,"title":"Webauth banner","desc":"Banner presented on the HTTP server login page (`ip http webauth-banner`). This is either literal banner text or a filepath pointing to a file whose contents are shown as the banner.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"httpsEnabled":{"name":"httpsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the embedded HTTPS management server is enabled (`ip http secure-server`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"httpsPort":{"name":"httpsPort","type":"\u0005","is_mandatory":true,"title":"TCP port the HTTPS server listens on, when a non-default port is configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"maxConnections":{"name":"maxConnections","type":"\u0005","is_mandatory":true,"title":"Maximum number of concurrent HTTP server connections (`ip http max-connections`), if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"radiusSourceInterface":{"name":"radiusSourceInterface","type":"\u001bcisco.iosxe.interface","title":"Interface used for outgoing RADIUS packets, resolved from radiusSourceInterfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"radiusSourceInterfaceName":{"name":"radiusSourceInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the interface sourcing outgoing RADIUS packets (`ip radius source-interface`), if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceRouteEnabled":{"name":"sourceRouteEnabled","type":"\u0004","is_mandatory":true,"title":"Whether IP source routing is enabled (`ip source-route`); enabled source routing is a known security risk","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"tacacsSourceInterface":{"name":"tacacsSourceInterface","type":"\u001bcisco.iosxe.interface","title":"Interface used for outgoing TACACS+ packets, resolved from tacacsSourceInterfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"tacacsSourceInterfaceName":{"name":"tacacsSourceInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the interface sourcing outgoing TACACS+ packets (`ip tacacs source-interface`), if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"tftpSourceInterface":{"name":"tftpSourceInterface","type":"\u001bcisco.iosxe.interface","title":"Interface used for TFTP connections, resolved from tftpSourceInterfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"tftpSourceInterfaceName":{"name":"tftpSourceInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the interface sourcing TFTP connections (`ip tftp source-interface`), if configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE IP services configuration","desc":"Global IP service settings parsed from `show running-config all | sec ip`, covering the embedded HTTP/HTTPS management server, its authentication and connection limits, IP source routing, and the source interfaces used for TFTP, RADIUS, and TACACS+ traffic. These controls decide whether the device exposes a web management plane and how tightly it is bounded, so they are prime hardening targets.","private":true,"defaults":"sourceRouteEnabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.keyChain":{"id":"cisco.iosxe.keyChain","name":"cisco.iosxe.keyChain","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-text description of the key chain, empty when none is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"key":{"name":"key","type":"\u001bcisco.iosxe.keyChain.key","title":"Cisco IOS XE key chain key","desc":"A single key within a key chain, holding the shared secret plus the accept and send lifetimes that bound when it may be used. Overlapping accept and send windows across keys enable hitless key rollover; a key with no lifetimes is always valid. The stored keyString is what protocol neighbor authentication actually verifies against.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"keys":{"name":"keys","type":"\u0019\u001bcisco.iosxe.keyChain.key","is_mandatory":true,"title":"Keys belonging to this key chain","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The name of the key chain.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE authentication key chain","desc":"A key chain (`key chain \u003cname\u003e`) grouping one or more authentication keys, parsed from the running config. Key chains supply the rotating shared secrets used by routing protocols such as EIGRP and OSPF for neighbor authentication. The keys field exposes each key's secret, encoding, and validity windows; key chains with no keys are still listed.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.keyChain.key":{"id":"cisco.iosxe.keyChain.key","name":"cisco.iosxe.keyChain.key","fields":{"acceptLifetime":{"name":"acceptLifetime","type":"\u001bcisco.iosxe.keyChain.key.lifetime","is_mandatory":true,"title":"Accept lifetime","desc":"Time window during which this key is accepted for authenticating received routing packets. Null when no accept-lifetime is configured (key always valid for receiving).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Key string encryption type","desc":"Encoding of keyString: `0` for an unencrypted (cleartext) secret or `7` for a Cisco type-7 (reversible Vigenere) encrypted secret. Empty when no encoding prefix is present.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric key identifier that orders keys within the chain","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyString":{"name":"keyString","type":"\u0007","is_mandatory":true,"title":"The shared secret string used for protocol authentication, subject to the encryptionType encoding","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keychain":{"name":"keychain","type":"\u0007","is_mandatory":true,"title":"Name of the key chain this key belongs to.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lifetime":{"name":"lifetime","type":"\u001bcisco.iosxe.keyChain.key.lifetime","title":"Cisco IOS XE key lifetime window","desc":"The start and end timestamps bounding when a key chain key is valid. An open-ended `infinite` end date is represented as the maximum future time, meaning the key never expires.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"sendLifetime":{"name":"sendLifetime","type":"\u001bcisco.iosxe.keyChain.key.lifetime","is_mandatory":true,"title":"Send lifetime","desc":"Time window during which this key is used to authenticate outgoing routing packets. Null when no send-lifetime is configured (key always valid for sending).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE key chain key","desc":"A single key within a key chain, holding the shared secret plus the accept and send lifetimes that bound when it may be used. Overlapping accept and send windows across keys enable hitless key rollover; a key with no lifetimes is always valid. The stored keyString is what protocol neighbor authentication actually verifies against.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.keyChain.key.lifetime":{"id":"cisco.iosxe.keyChain.key.lifetime","name":"cisco.iosxe.keyChain.key.lifetime","fields":{"end":{"name":"end","type":"\t","is_mandatory":true,"title":"End of the lifetime window; a far-future value indicates an `infinite` (never-expiring) key","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"start":{"name":"start","type":"\t","is_mandatory":true,"title":"Start of the lifetime window","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE key lifetime window","desc":"The start and end timestamps bounding when a key chain key is valid. An open-ended `infinite` end date is represented as the maximum future time, meaning the key never expires.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.loggingConfiguration":{"id":"cisco.iosxe.loggingConfiguration","name":"cisco.iosxe.loggingConfiguration","fields":{"bufferDiscriminator":{"name":"bufferDiscriminator","type":"\u0007","is_mandatory":true,"title":"Optional. The name of the logging discriminator used by the log buffer if configured. Empty otherwise.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bufferSeverity":{"name":"bufferSeverity","type":"\u0007","is_mandatory":true,"title":"Severity level of messages sent to the log buffer.","desc":"One of emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), or debugging (7), named or numeric. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bufferSize":{"name":"bufferSize","type":"\u0005","is_mandatory":true,"title":"Optional. The size of the logging buffer in bytes if buffered logging is enabled. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"configurationChangesLoggingEnabled":{"name":"configurationChangesLoggingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether configuration-change logging is enabled (`archive`, `log config`, `logging enable`), which records commands entered on the device.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleSeverity":{"name":"consoleSeverity","type":"\u0007","is_mandatory":true,"title":"Severity level of messages sent to the console.","desc":"One of emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), or debugging (7), named or numeric. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"host":{"name":"host","type":"\u001bcisco.iosxe.loggingConfiguration.host","title":"Cisco IOS XE logging host","desc":"A single remote syslog destination the device sends system and debug logs to, from `logging host`, with a flag for whether the address is IPv6.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"hosts":{"name":"hosts","type":"\u0019\u001bcisco.iosxe.loggingConfiguration.host","is_mandatory":true,"title":"Remote hosts configured on the device to which system and debug logs are sent.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logSuccessfulLogin":{"name":"logSuccessfulLogin","type":"\u0004","is_mandatory":true,"title":"Whether successful logins are logged (`login on-success log`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logUnsuccessfulLogin":{"name":"logUnsuccessfulLogin","type":"\u0004","is_mandatory":true,"title":"Whether unsuccessful (failed) logins are logged (`login on-failure log`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceInterface":{"name":"sourceInterface","type":"\u001bcisco.iosxe.loggingConfiguration.sourceInterface","title":"Cisco IOS XE logging source-interface binding","desc":"A `logging source-interface` statement from the running-config, which forces syslog messages sent to remote collectors to carry the address of the named interface as their source. Auditing the source interface matters because syslog receivers and firewalls are commonly keyed on a stable management-address; a missing or wrong binding can cause logs to be dropped or attributed to the wrong device. The name field is the interface as written in the config (for example `Loopback0`), and vrfName is the VRF the binding is scoped to when present.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"sourceInterfaces":{"name":"sourceInterfaces","type":"\u0019\u001bcisco.iosxe.loggingConfiguration.sourceInterface","is_mandatory":true,"title":"Source interfaces configured on the device as the source address of outbound system logging packets.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapSeverity":{"name":"trapSeverity","type":"\u0007","is_mandatory":true,"title":"Severity level of messages sent to remote syslog (trap) hosts.","desc":"One of emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), or debugging (7), named or numeric. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE logging configuration","desc":"System logging (syslog) configuration of the device, covering configuration-change logging, login success and failure logging, the local log buffer and its severity filter, and the remote syslog hosts and source interfaces. Collected from `show running-config all | include logging`. Use it to confirm that login events are logged and that logs are exported to remote syslog hosts.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.loggingConfiguration.host":{"id":"cisco.iosxe.loggingConfiguration.host","name":"cisco.iosxe.loggingConfiguration.host","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"IP address or hostname of the remote syslog host.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"isIpv6":{"name":"isIpv6","type":"\u0004","is_mandatory":true,"title":"Whether the host address is an IPv6 address.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE logging host","desc":"A single remote syslog destination the device sends system and debug logs to, from `logging host`, with a flag for whether the address is IPv6.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.loggingConfiguration.sourceInterface":{"id":"cisco.iosxe.loggingConfiguration.sourceInterface","name":"cisco.iosxe.loggingConfiguration.sourceInterface","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface whose address is used as the syslog source, as written in the","desc":"running-config (for example `Loopback0` or `GigabitEthernet0/1`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"srcInterface":{"name":"srcInterface","type":"\u001bcisco.iosxe.interface","title":"Interface resource resolved from name","desc":"Matching interface out of the device interface list, giving access to its addresses, status, and configuration. Null when no interface with that name exists on the device.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrfName":{"name":"vrfName","type":"\u0007","is_mandatory":true,"title":"VRF the source-interface binding is scoped to","desc":"Virtual Routing and Forwarding instance named in the `vrf` keyword of the `logging source-interface` statement. Empty when the binding applies to the global (default) routing table.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE logging source-interface binding","desc":"A `logging source-interface` statement from the running-config, which forces syslog messages sent to remote collectors to carry the address of the named interface as their source. Auditing the source interface matters because syslog receivers and firewalls are commonly keyed on a stable management-address; a missing or wrong binding can cause logs to be dropped or attributed to the wrong device. The name field is the interface as written in the config (for example `Loopback0`), and vrfName is the VRF the binding is scoped to when present.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.ntpConfiguration":{"id":"cisco.iosxe.ntpConfiguration","name":"cisco.iosxe.ntpConfiguration","fields":{"authenticate":{"name":"authenticate","type":"\u0004","is_mandatory":true,"title":"Whether `ntp authenticate` is configured, requiring NTP peers to present a","desc":"trusted authentication key before their time is accepted.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authenticationKey":{"name":"authenticationKey","type":"\u001bcisco.iosxe.ntpConfiguration.authenticationKey","title":"Cisco IOS XE NTP authentication key","desc":"An `ntp authentication-key` entry, holding the shared secret used to authenticate NTP associations. Referenced by servers via keyId and marked as accepted through the trustedKeys list. The keyId field selects the entry (for example `.authenticationKeys.where(keyId == 1)`).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"authenticationKeys":{"name":"authenticationKeys","type":"\u0019\u001bcisco.iosxe.ntpConfiguration.authenticationKey","is_mandatory":true,"title":"Every `ntp authentication-key` entry configured on the device, each carrying","desc":"its key number, algorithm, and (encrypted) key value.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"server":{"name":"server","type":"\u001bcisco.iosxe.ntpConfiguration.server","title":"Cisco IOS XE NTP server","desc":"A single `ntp server` statement, describing one upstream time source and how the device polls and authenticates it. The address field selects the entry (for example `.servers.where(address == \"8.8.8.8\")`). Pair keyId with the device trustedKeys list to confirm the association is authenticated.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001bcisco.iosxe.ntpConfiguration.server","title":"Configured NTP time sources","desc":"NTP servers from `show running-config all | include ntp server`, each with its address, optional authentication key, VRF, poll intervals, and burst flags.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceInterface":{"name":"sourceInterface","type":"\u001bcisco.iosxe.interface","title":"Source interface resource resolved from sourceInterfaceName","desc":"Matching interface out of the device interface list. Null when no source interface is configured or no interface with that name exists.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceInterfaceName":{"name":"sourceInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the interface set with `ntp source`, whose address is used as the","desc":"source of outbound NTP packets. Empty when no source interface is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trustedKey":{"name":"trustedKey","type":"\u001bcisco.iosxe.ntpConfiguration.trustedKey","title":"Cisco IOS XE NTP trusted key","desc":"An `ntp trusted-key` statement, declaring which authentication keys the device will accept when validating NTP peers. A statement may name a single key or a range (`ntp trusted-key 1 - 3`); the keyId field is the low end of the range and keyRangeEnd the high end. Only keys in the trust list are honored even if an association references them.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"trustedKeys":{"name":"trustedKeys","type":"\u0019\u001bcisco.iosxe.ntpConfiguration.trustedKey","is_mandatory":true,"title":"Every `ntp trusted-key` statement, defining which authentication keys the","desc":"device will accept from NTP peers. Ranges are expanded per entry.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE NTP configuration","desc":"Network Time Protocol settings parsed from `show running-config | include ntp`. Time synchronization is a security-relevant control: authenticated NTP prevents an attacker from skewing the device clock to invalidate certificate checks, replay-protection windows, and log timestamps. The authenticate field reports whether `ntp authenticate` is set, servers lists the configured time sources, and authenticationKeys / trustedKeys expose the key material and the trust list used to validate them. Audit with `cisco.iosxe.ntp.authenticate` and cross-check that every server has a keyId whose key also appears in trustedKeys.","private":true,"defaults":"authenticate","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.ntpConfiguration.authenticationKey":{"id":"cisco.iosxe.ntpConfiguration.authenticationKey","name":"cisco.iosxe.ntpConfiguration.authenticationKey","fields":{"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"Cryptographic algorithm keyword","desc":"Algorithm used to compute the message digest, as written after the key number. Commonly `md5`; newer releases also support `cmac-aes-128`, `hmac-sha1`, `hmac-sha2-256`, and `sha2`. MD5 is considered weak and its presence is a hardening finding.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Key value encoding type","desc":"Numeric encoding of the stored key value: `0` for cleartext, `7` for Cisco type-7 (weak, reversible) encoding, and `6` for type-6 AES encryption when `password encryption aes` is enabled. Empty when no encoding token is present.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Configured key value. Stored in the running-config in the form indicated by","desc":"encryptionType (cleartext or reversibly encrypted), not as a one-way hash.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyId":{"name":"keyId","type":"\u0005","is_mandatory":true,"title":"Key number that servers and trusted-key statements reference (the value after","desc":"`ntp authentication-key`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE NTP authentication key","desc":"An `ntp authentication-key` entry, holding the shared secret used to authenticate NTP associations. Referenced by servers via keyId and marked as accepted through the trustedKeys list. The keyId field selects the entry (for example `.authenticationKeys.where(keyId == 1)`).","private":true,"defaults":"keyId","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.ntpConfiguration.server":{"id":"cisco.iosxe.ntpConfiguration.server","name":"cisco.iosxe.ntpConfiguration.server","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Host name or IP address (IPv4 or IPv6) of the NTP server, as written in the","desc":"configuration.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authenticationKey":{"name":"authenticationKey","type":"\u001bcisco.iosxe.ntpConfiguration.authenticationKey","title":"Authentication key resource resolved from keyId","desc":"Matching entry out of authenticationKeys, giving the algorithm and key value used to authenticate this server. Null when keyId is unset or no matching key exists.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"burst":{"name":"burst","type":"\u0004","is_mandatory":true,"title":"Whether the `burst` keyword is set, sending a burst of packets each poll","desc":"interval when the server is reachable.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"iburst":{"name":"iburst","type":"\u0004","is_mandatory":true,"title":"Whether the `iburst` keyword is set, sending an initial burst of packets when","desc":"the server is unreachable to speed up the first synchronization.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyId":{"name":"keyId","type":"\u0005","is_mandatory":true,"title":"Number of the `ntp authentication-key` used to authenticate this server, from","desc":"the `key` keyword. Null (unset) when the association is unauthenticated.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"maxPoll":{"name":"maxPoll","type":"\u0005","is_mandatory":true,"title":"Maximum poll interval as a power-of-two exponent","desc":"Value of the `maxpoll` keyword. This is not seconds directly; it is the base-2 exponent of the longest interval between polls, so a value of 10 means 2^10 = 1024 seconds. Range 4 through 17. Null when unset (device default is 10, i.e. 1024 seconds).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"minPoll":{"name":"minPoll","type":"\u0005","is_mandatory":true,"title":"Minimum poll interval as a power-of-two exponent","desc":"Value of the `minpoll` keyword. This is the base-2 exponent of the shortest interval between polls, so a value of 6 means 2^6 = 64 seconds. Range 4 through 17. Null when unset (device default is 6, i.e. 64 seconds).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"NTP protocol version from the `version` keyword (1 through 4). Null when","desc":"unset; the device default is version 4.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF named in the `vrf` keyword, identifying the routing table used to reach","desc":"this server. Empty when the server is reached through the global routing table.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE NTP server","desc":"A single `ntp server` statement, describing one upstream time source and how the device polls and authenticates it. The address field selects the entry (for example `.servers.where(address == \"8.8.8.8\")`). Pair keyId with the device trustedKeys list to confirm the association is authenticated.","private":true,"defaults":"address","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.ntpConfiguration.trustedKey":{"id":"cisco.iosxe.ntpConfiguration.trustedKey","name":"cisco.iosxe.ntpConfiguration.trustedKey","fields":{"keyId":{"name":"keyId","type":"\u0005","is_mandatory":true,"title":"Key number to be trusted, or the low end when a range is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyRangeEnd":{"name":"keyRangeEnd","type":"\u0005","is_mandatory":true,"title":"High end of the trusted key range when the statement uses `keyId - keyRangeEnd`","desc":"form. Null when a single key is trusted.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keys":{"name":"keys","type":"\u0019\u001bcisco.iosxe.ntpConfiguration.authenticationKey","title":"Authentication keys covered by this trusted-key statement","desc":"Matching entries out of the device authenticationKeys. When a range is configured, every key whose number falls within keyId through keyRangeEnd is included; otherwise only the single key with number keyId.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE NTP trusted key","desc":"An `ntp trusted-key` statement, declaring which authentication keys the device will accept when validating NTP peers. A statement may name a single key or a range (`ntp trusted-key 1 - 3`); the keyId field is the low end of the range and keyRangeEnd the high end. Only keys in the trust list are honored even if an association references them.","private":true,"defaults":"keyId","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.passwordEncryption":{"id":"cisco.iosxe.passwordEncryption","name":"cisco.iosxe.passwordEncryption","fields":{"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Cisco encryption type","desc":"Numeric algorithm identifier: `0` cleartext, `4` SHA-256 (flawed, deprecated), `5` salted MD5, `7` Vigenere (reversible, trivially cracked), `8` PBKDF2 with SHA-256, `9` scrypt. May be absent when no encoding prefix is present. Types 8 and 9 are the recommended strong options; types 0 and 7 provide no real protection.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"level":{"name":"level","type":"\u0005","is_mandatory":true,"title":"Privilege level this credential grants, when an `enable password level N` or `enable secret level N` form is used","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"The type of password encryption. This can be either `password` or `secret`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"The encryption value","desc":"Depending on the encryption type, this can be either plain text or an encrypted value. It can also be a reversible or non-reversible hash.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE password or secret encryption","desc":"A single stored credential from `enable password` or `enable secret`, capturing its encryption type and encoded value. The encryption type distinguishes reversible or weak encodings (cleartext, Vigenere, salted MD5) from modern hashes (PBKDF2, scrypt), making this the field to audit for weak enable credentials.","private":true,"defaults":"type encryptionType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.routerEigrpAddressFamily":{"id":"cisco.iosxe.routerEigrpAddressFamily","name":"cisco.iosxe.routerEigrpAddressFamily","fields":{"autonomousSystemNumber":{"name":"autonomousSystemNumber","type":"\u0005","is_mandatory":true,"title":"Autonomous system (AS) number for this EIGRP address family, when configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"castType":{"name":"castType","type":"\u0007","is_mandatory":true,"title":"Cast type of the address family, `unicast` or `multicast`, when specified","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interfaces":{"name":"interfaces","type":"\u0019\u001bcisco.iosxe.routerEigrpAddressFamilyInterface","is_mandatory":true,"title":"Per-interface EIGRP settings within this address family","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Address family protocol, `ipv4` or `ipv6`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrfName":{"name":"vrfName","type":"\u0007","is_mandatory":true,"title":"Name of the VRF this address family applies to, empty for the global routing table","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE EIGRP address family","desc":"One address-family block within a named-mode EIGRP process, parsed from the running config. Identifies the protocol, cast type, VRF, and autonomous system number, and holds the per-interface settings (including authentication) under interfaces.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.routerEigrpAddressFamilyInterface":{"id":"cisco.iosxe.routerEigrpAddressFamilyInterface","name":"cisco.iosxe.routerEigrpAddressFamilyInterface","fields":{"afInterface":{"name":"afInterface","type":"\u001bcisco.iosxe.interface","title":"Interface this address-family block applies to, resolved from interfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authKeychain":{"name":"authKeychain","type":"\u001bcisco.iosxe.keyChain","title":"Key chain used for EIGRP authentication on this interface, resolved from keychainName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authenticationMode":{"name":"authenticationMode","type":"\u0007","is_mandatory":true,"title":"Authentication mode","desc":"EIGRP packet authentication algorithm for this interface, either `md5` or the stronger `hmac-sha-256`. Empty when authentication is not configured, meaning EIGRP packets on the interface are unauthenticated.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interfaceName":{"name":"interfaceName","type":"\u0007","is_mandatory":true,"title":"The name of the interface.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keychainName":{"name":"keychainName","type":"\u0007","is_mandatory":true,"title":"Name of the key chain supplying authentication keys for this interface, when configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE EIGRP address-family interface","desc":"Per-interface EIGRP settings inside a named-mode address family (the `af-interface` block), parsed from the running config. The authentication mode and key chain fields determine whether EIGRP packets on this interface are cryptographically authenticated, making this the field to check when auditing EIGRP neighbor trust.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.routerEigrpEntry":{"id":"cisco.iosxe.routerEigrpEntry","name":"cisco.iosxe.routerEigrpEntry","fields":{"addressFamilies":{"name":"addressFamilies","type":"\u0019\u001bcisco.iosxe.routerEigrpAddressFamily","is_mandatory":true,"title":"Address families (IPv4/IPv6, per VRF) configured under this EIGRP process","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The router EIGRP group name.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE EIGRP process","desc":"An EIGRP routing process (`router eigrp \u003cname\u003e`) parsed from the running config in named mode, keyed on its process name. The address families field breaks the process out by protocol and VRF. EIGRP neighbor authentication is configured per address-family interface, so this resource is the entry point for auditing EIGRP routing security.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.routerOspfEntry":{"id":"cisco.iosxe.routerOspfEntry","name":"cisco.iosxe.routerOspfEntry","fields":{"area":{"name":"area","type":"\u001bcisco.iosxe.routerOspfEntry.area","title":"OSPF area within a Cisco IOS XE router OSPF process","desc":"Per-area OSPF settings parsed from `show running-config all | sec router ospf`. Each area exposes whether authentication is required for its links, whether that authentication uses MD5 message digests, and the default cost injected into stub and not-so-stubby areas. The area is selected by its areaId, so an audit can assert that every non-backbone area enforces authentication, for example `.areas.where(areaId != \"0\") { authenticationEnabled }`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"areas":{"name":"areas","type":"\u0019\u001bcisco.iosxe.routerOspfEntry.area","is_mandatory":true,"title":"Areas configured under this OSPF process","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"processId":{"name":"processId","type":"\u0007","is_mandatory":true,"title":"The OSPF process ID.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE OSPF process","desc":"An OSPFv2 routing process (`router ospf \u003cprocess-id\u003e`) parsed from the running config, keyed on the process ID. The areas field exposes each configured area and its authentication settings. OSPF area authentication is a common audit target, so this resource anchors OSPF routing-security checks.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.routerOspfEntry.area":{"id":"cisco.iosxe.routerOspfEntry.area","name":"cisco.iosxe.routerOspfEntry.area","fields":{"areaId":{"name":"areaId","type":"\u0007","is_mandatory":true,"title":"Area identifier, expressed either as a decimal number or in dotted IP-address notation (for example \"0\" or \"0.0.0.0\" for the backbone area)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authenticationEnabled":{"name":"authenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether authentication is required for all interfaces in the area","desc":"True when `area \u003cid\u003e authentication` is configured, which turns on plaintext-password authentication for every OSPF link in the area unless an interface overrides it. Combine with md5AuthenticationEnabled to tell simple password authentication apart from cryptographic authentication.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"defaultCost":{"name":"defaultCost","type":"\u0005","is_mandatory":true,"title":"Default cost advertised into a stub or not-so-stubby area","desc":"Metric that the area border router assigns to the default route it injects into a stub or NSSA area, set by `area \u003cid\u003e default-cost \u003ccost\u003e` (range 0 to 16777215). Zero when no explicit default cost is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationEnabled":{"name":"md5AuthenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether MD5 message-digest authentication is required for the area","desc":"True when `area \u003cid\u003e authentication message-digest` is configured, which forces cryptographic (keyed MD5) authentication on the area's OSPF adjacencies rather than the weaker plaintext password scheme.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"OSPF area within a Cisco IOS XE router OSPF process","desc":"Per-area OSPF settings parsed from `show running-config all | sec router ospf`. Each area exposes whether authentication is required for its links, whether that authentication uses MD5 message digests, and the default cost injected into stub and not-so-stubby areas. The area is selected by its areaId, so an audit can assert that every non-backbone area enforces authentication, for example `.areas.where(areaId != \"0\") { authenticationEnabled }`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.serviceConfig":{"id":"cisco.iosxe.serviceConfig","name":"cisco.iosxe.serviceConfig","fields":{"logTimestampFormats":{"name":"logTimestampFormats","type":"\u0019\u001bcisco.iosxe.timestampFormat","is_mandatory":true,"title":"Timestamp formatting for `service timestamps`, one entry per message class","desc":"(debug and log), describing whether messages are stamped with uptime or the wall-clock date and time.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"padEnabled":{"name":"padEnabled","type":"\u0004","is_mandatory":true,"title":"Whether `service pad` is enabled, allowing X.25 Packet Assembler/Disassembler","desc":"connections. Usually disabled for hardening.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordEncryptionEnabled":{"name":"passwordEncryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether `service password-encryption` is enabled, applying weak type-7","desc":"encoding to cleartext passwords stored in the running-config.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"tcpKeepalivesInEnabled":{"name":"tcpKeepalivesInEnabled","type":"\u0004","is_mandatory":true,"title":"Whether `service tcp-keepalives-in` is enabled, sending keepalives on incoming","desc":"TCP connections so idle or dead inbound sessions are detected and cleared.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"tcpKeepalivesOutEnabled":{"name":"tcpKeepalivesOutEnabled","type":"\u0004","is_mandatory":true,"title":"Whether `service tcp-keepalives-out` is enabled, sending keepalives on outgoing","desc":"TCP connections so idle or dead outbound sessions are detected and cleared.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE service configuration","desc":"The `service ...` global options parsed from `show running-config all | include service`, several of which are hardening controls. Notably passwordEncryptionEnabled reflects `service password-encryption`, and the TCP keepalive flags help reap dead management sessions. logTimestampFormats captures how debug and log messages are timestamped.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.snmpCommunity":{"id":"cisco.iosxe.snmpCommunity","name":"cisco.iosxe.snmpCommunity","fields":{"accessType":{"name":"accessType","type":"\u0007","is_mandatory":true,"title":"Access level granted by the community","desc":"Either `RO` for read-only or `RW` for read-write. RW communities allow configuration changes over SNMP and warrant close scrutiny. Empty when the level could not be determined.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"acl":{"name":"acl","type":"\u001bcisco.iosxe.accessListEntry","title":"Access-list entry resolved from aclId","desc":"Matching entry out of the device access-lists, exposing its permit and deny rules. Null when no access-list is applied or no matching entry exists.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aclId":{"name":"aclId","type":"\u0007","is_mandatory":true,"title":"Number or name of the access-list restricting which source addresses may use","desc":"this community. Empty when no access-list is applied, meaning the community is usable from any source.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"index":{"name":"index","type":"\u0007","is_mandatory":true,"title":"Community index reported by `show snmp community`, distinguishing entries that","desc":"share a name across contexts or engine IDs.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Community string value that acts as the SNMP access credential.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"securityName":{"name":"securityName","type":"\u0007","is_mandatory":true,"title":"SNMPv3 security name mapped to this community (used by the community-to-security","desc":"mapping for VACM). Empty when none is reported.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE SNMP community string","desc":"An SNMP community, which for SNMPv1/v2c functions as a shared password granting read-only or read-write access to the device MIB. Because the string travels in cleartext, an RW community without an access-list is a serious exposure. Select with name and accessType and confirm aclId is set (for example `.communities.where(accessType == \"RW\")`).","private":true,"defaults":"name accessType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.snmpConfiguration":{"id":"cisco.iosxe.snmpConfiguration","name":"cisco.iosxe.snmpConfiguration","fields":{"communities":{"name":"communities","type":"\u0019\u001bcisco.iosxe.snmpCommunity","title":"SNMP community strings from `show snmp community` merged with `show","desc":"running-config | include snmp-server community`, including each string's access level and any applied access-list.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether an SNMP agent is running, derived from `show snmp community` (false","desc":"when the device reports \"SNMP agent not enabled\" or returns nothing).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"group":{"name":"group","type":"\u001bcisco.iosxe.snmpConfiguration.group","title":"Cisco IOS XE SNMP group","desc":"An SNMP group from `show snmp group`, which binds a security model and set of views (and therefore a level of access) to the users mapped into it. The name field selects the group. A group's per-security-model detail lives in configurations.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"groupConfiguration":{"name":"groupConfiguration","type":"\u001bcisco.iosxe.snmpConfiguration.groupConfiguration","title":"Cisco IOS XE SNMP access-control group","desc":"Access-control settings for one security level of an SNMP group, parsed from `show snmp group`. Each group maps a security model and level to the MIB views it may read, write, and receive notifications from. The combination of securityModel plus the read and write views determines what management data an SNMP session bound to this group can see or change, so these entries are central to auditing SNMP exposure.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"groups":{"name":"groups","type":"\u0019\u001bcisco.iosxe.snmpConfiguration.group","title":"SNMP groups from `show snmp group`, defining the security model and read,","desc":"write, and notify views bound to each group.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hostConfig":{"name":"hostConfig","type":"\u001bcisco.iosxe.snmpConfiguration.hostConfig","title":"Cisco IOS XE SNMP notification host","desc":"A host configured as an SNMP notification receiver via `snmp-server host`. The host field carries the receiver address (and any trailing options) as parsed from the running-config, and selects the entry.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"notificationHosts":{"name":"notificationHosts","type":"\u0019\u001bcisco.iosxe.snmpConfiguration.hostConfig","title":"Hosts configured as SNMP notification receivers via `snmp-server host`, parsed","desc":"from `show running-config | include snmp-server`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"notificationTraps":{"name":"notificationTraps","type":"\u0019\u001bcisco.iosxe.snmpConfiguration.trapConfig","title":"Enabled SNMP notification (trap and inform) categories from `show","desc":"running-config | include snmp-server`, each an `snmp-server enable traps` selection.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapConfig":{"name":"trapConfig","type":"\u001bcisco.iosxe.snmpConfiguration.trapConfig","title":"Cisco IOS XE SNMP notification category","desc":"A single enabled SNMP notification category from `snmp-server enable traps`, captured verbatim. The notificationTypes field selects the entry (for example `ospf cisco-specific errors config-error`).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"user":{"name":"user","type":"\u001bcisco.iosxe.snmpConfiguration.user","title":"Cisco IOS XE SNMP user","desc":"SNMPv3 user account parsed from `show snmp user`, keyed on username. Each user is tied to an SNMP group (which supplies its view-based access) and, for authPriv/authNoPriv users, to authentication and privacy protocols. Weak or absent authProtocol/privacyProtocol values, or an unrestricted aclId, indicate an SNMP user that offers little protection.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bcisco.iosxe.snmpConfiguration.user","title":"SNMPv3 users from `show snmp user`, including their engine ID, group, and","desc":"authentication and privacy protocols.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE SNMP configuration","desc":"Simple Network Management Protocol settings gathered from a mix of `show snmp ...` and `show running-config | include snmp-server` commands. SNMP is a frequent attack surface: SNMPv1/v2c community strings are sent in cleartext and act as effective passwords, so auditing communities, access-lists, groups, and users is central to hardening. Check enabled first, then flag any RW community or any community without an acl.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.snmpConfiguration.group":{"id":"cisco.iosxe.snmpConfiguration.group","name":"cisco.iosxe.snmpConfiguration.group","fields":{"configurations":{"name":"configurations","type":"\u0019\u001bcisco.iosxe.snmpConfiguration.groupConfiguration","is_mandatory":true,"title":"Per-security-model configuration rows for this group","desc":"One entry per security model the group is defined under, each giving the context, storage type, and read, write, and notify views. A group can appear under several models (for example `v1`, `v2c`, `v3 priv`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the SNMP group that users are mapped into.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE SNMP group","desc":"An SNMP group from `show snmp group`, which binds a security model and set of views (and therefore a level of access) to the users mapped into it. The name field selects the group. A group's per-security-model detail lives in configurations.","private":true,"defaults":"name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.snmpConfiguration.groupConfiguration":{"id":"cisco.iosxe.snmpConfiguration.groupConfiguration","name":"cisco.iosxe.snmpConfiguration.groupConfiguration","fields":{"contextName":{"name":"contextName","type":"\u0007","is_mandatory":true,"title":"SNMP context name bound to this group, empty when the group applies to the default context","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"readView":{"name":"readView","type":"\u0007","is_mandatory":true,"title":"Name of the MIB view this group may read, empty when no read view is assigned","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"rowStatus":{"name":"rowStatus","type":"\u0007","is_mandatory":true,"title":"Row status","desc":"Conceptual-row state from the SNMPv2-TC RowStatus textual convention. Usually `active`; other states include `notInService` and `notReady`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"securityModel":{"name":"securityModel","type":"\u0007","is_mandatory":true,"title":"Security model and level","desc":"Security model and level enforced for this group. Values are `v1`, `v2c`, or one of the SNMPv3 levels `v3 noauth` (no authentication, no privacy), `v3 auth` (authentication, no encryption), or `v3 priv` (authentication plus encryption). Trailing whitespace from the command output is trimmed. `v1` and `v2c` offer no cryptographic protection.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"storageType":{"name":"storageType","type":"\u0007","is_mandatory":true,"title":"Storage type","desc":"How the group entry is persisted, from the SNMP-FRAMEWORK-MIB StorageType. Typical values are `nonvolatile` (survives reload), `volatile` (lost on reload), `permanent`, and `read-only`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"writeView":{"name":"writeView","type":"\u0007","is_mandatory":true,"title":"Name of the MIB view this group may write to, empty when no write view is assigned","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE SNMP access-control group","desc":"Access-control settings for one security level of an SNMP group, parsed from `show snmp group`. Each group maps a security model and level to the MIB views it may read, write, and receive notifications from. The combination of securityModel plus the read and write views determines what management data an SNMP session bound to this group can see or change, so these entries are central to auditing SNMP exposure.","private":true,"defaults":"securityModel","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.snmpConfiguration.hostConfig":{"id":"cisco.iosxe.snmpConfiguration.hostConfig","name":"cisco.iosxe.snmpConfiguration.hostConfig","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Notification receiver as written in the `snmp-server host` statement,","desc":"beginning with the host address or name.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE SNMP notification host","desc":"A host configured as an SNMP notification receiver via `snmp-server host`. The host field carries the receiver address (and any trailing options) as parsed from the running-config, and selects the entry.","private":true,"defaults":"host","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.snmpConfiguration.trapConfig":{"id":"cisco.iosxe.snmpConfiguration.trapConfig","name":"cisco.iosxe.snmpConfiguration.trapConfig","fields":{"notificationTypes":{"name":"notificationTypes","type":"\u0007","is_mandatory":true,"title":"Notification category and sub-options as written after `snmp-server enable","desc":"traps` (for example `ospf cisco-specific errors config-error`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE SNMP notification category","desc":"A single enabled SNMP notification category from `snmp-server enable traps`, captured verbatim. The notificationTypes field selects the entry (for example `ospf cisco-specific errors config-error`).","private":true,"defaults":"notificationTypes","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.snmpConfiguration.user":{"id":"cisco.iosxe.snmpConfiguration.user","name":"cisco.iosxe.snmpConfiguration.user","fields":{"aclId":{"name":"aclId","type":"\u0007","is_mandatory":true,"title":"The access list name or number associated to the user, if any.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authProtocol":{"name":"authProtocol","type":"\u0007","is_mandatory":true,"title":"Authentication protocol","desc":"Hash used to authenticate this user's SNMPv3 requests, one of `md5`, `sha`, or the stronger SHA-2 variants `sha-256`/`sha-512` where supported. Empty when the user has no authentication (noAuthNoPriv).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"engineId":{"name":"engineId","type":"\u0007","is_mandatory":true,"title":"SNMPv3 authoritative engine ID that scopes this user","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"groupName":{"name":"groupName","type":"\u0007","is_mandatory":true,"title":"Name of the SNMP group this user belongs to, which supplies its view-based access rights","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"privacyProtocol":{"name":"privacyProtocol","type":"\u0007","is_mandatory":true,"title":"Privacy protocol","desc":"Cipher used to encrypt this user's SNMPv3 payloads, such as `des`, `3des`, or `aes` (`aes-128`/`aes-192`/`aes-256`). Empty when the user has no privacy configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"rowStatus":{"name":"rowStatus","type":"\u0007","is_mandatory":true,"title":"Row status","desc":"Conceptual-row state from the SNMPv2-TC RowStatus textual convention, usually `active`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"storageType":{"name":"storageType","type":"\u0007","is_mandatory":true,"title":"Storage type","desc":"How the user entry is persisted, from the SNMP-FRAMEWORK-MIB StorageType. Typical values are `nonvolatile`, `volatile`, `permanent`, and `read-only`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"The username of the SNMP user.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE SNMP user","desc":"SNMPv3 user account parsed from `show snmp user`, keyed on username. Each user is tied to an SNMP group (which supplies its view-based access) and, for authPriv/authNoPriv users, to authentication and privacy protocols. Weak or absent authProtocol/privacyProtocol values, or an unrestricted aclId, indicate an SNMP user that offers little protection.","private":true,"defaults":"username authProtocol privacyProtocol","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.sshConfig":{"id":"cisco.iosxe.sshConfig","name":"cisco.iosxe.sshConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the SSH server is enabled (true when the output reports \"SSH Enabled\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"maxRetries":{"name":"maxRetries","type":"\u0005","is_mandatory":true,"title":"Maximum number of authentication attempts allowed per connection, defaulting to 3 with a maximum of 5","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"modulusSize":{"name":"modulusSize","type":"\u0005","is_mandatory":true,"title":"Minimum expected Diffie-Hellman key size in bits (for example 2048); keys below this size are rejected during key exchange","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"timeoutSeconds":{"name":"timeoutSeconds","type":"\u0005","is_mandatory":true,"title":"SSH login (authentication) timeout in seconds, defaulting to 120 and not exceeding 120","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"SSH protocol version offered by the server (for example \"2.0\" for SSHv2 only, \"1.99\" for SSHv1/v2 compatibility, or \"1.5\" for SSHv1)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"SSH server configuration on a Cisco IOS XE device","desc":"SSH daemon settings parsed from `show ip ssh`. Reports whether SSH is enabled, the protocol version offered, the login timeout, the authentication-retry limit, and the Diffie-Hellman modulus size. These are common hardening targets, for example requiring SSH version 2, a low retry count, and a 2048-bit or larger modulus.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.timestampFormat":{"id":"cisco.iosxe.timestampFormat","name":"cisco.iosxe.timestampFormat","fields":{"localTime":{"name":"localTime","type":"\u0004","is_mandatory":true,"title":"Whether the `localtime` keyword is set, rendering datetime timestamps in the","desc":"configured local time zone instead of UTC.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"messageType":{"name":"messageType","type":"\u0007","is_mandatory":true,"title":"Message class this format applies to: `debug` for `service timestamps debug`","desc":"or `log` for `service timestamps log`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"milliseconds":{"name":"milliseconds","type":"\u0004","is_mandatory":true,"title":"Whether the `msec` keyword is set, adding millisecond precision to timestamps.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"relativity":{"name":"relativity","type":"\u0007","is_mandatory":true,"title":"Timestamp base: uptime or wall-clock","desc":"Whether messages are stamped relative to boot or with the actual date:  - `uptime` indicates the timestamp is the time elapsed since the device last restarted. - `datetime` indicates the timestamp is the actual calendar date and time.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"showTimezone":{"name":"showTimezone","type":"\u0004","is_mandatory":true,"title":"Whether the `show-timezone` keyword is set, appending the time zone name to","desc":"timestamps.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"year":{"name":"year","type":"\u0004","is_mandatory":true,"title":"Whether the `year` keyword is set, including the year in datetime timestamps.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE timestamp format configuration","desc":"A single `service timestamps` directive, describing how one class of messages is timestamped. Accurate, dated timestamps (rather than uptime) are important for correlating logs across devices during an incident. The messageType field distinguishes the debug and log classes.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.user":{"id":"cisco.iosxe.user","name":"cisco.iosxe.user","fields":{"credential":{"name":"credential","type":"\u0007","is_mandatory":true,"title":"The encoded credential value for the user.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"credentialType":{"name":"credentialType","type":"\u0007","is_mandatory":true,"title":"Credential type, this can be either 'password' or 'secret'","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Credential encryption type","desc":"Numeric encoding of the stored credential. For a `password` this is `0` (cleartext) or `7` (reversible Vigenere); for a `secret` this is `0` (cleartext), `5` (salted MD5), `8` (PBKDF2 with SHA-256), or `9` (scrypt). Types 8 and 9 are the strong options.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"privilegeLevel":{"name":"privilegeLevel","type":"\u0005","is_mandatory":true,"title":"Privilege level","desc":"Command privilege level granted to the user, from 1 to 15. Level 1 is basic user EXEC and level 15 is full privileged (enable) access. Defaults to 1 when no level is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE local user account","desc":"A locally defined user (`username ...`) parsed from the running config, with its privilege level and stored credential. Privilege level and credential encoding are the key audit points: level 15 grants full administrative access, and weak encoding types leave the credential recoverable.","private":true,"defaults":"username privilegeLevel","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxe.vtyLine":{"id":"cisco.iosxe.vtyLine","name":"cisco.iosxe.vtyLine","fields":{"accessClassIn":{"name":"accessClassIn","type":"\u0007","is_mandatory":true,"title":"Inbound access-class number or name applied to the line, empty when none is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"accessClassOut":{"name":"accessClassOut","type":"\u0007","is_mandatory":true,"title":"Outbound access-class number or name applied to the line, empty when none is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aclIn":{"name":"aclIn","type":"\u001bcisco.iosxe.accessListEntry","title":"Access list resolved from accessClassIn, restricting which sources may connect inbound","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aclOut":{"name":"aclOut","type":"\u001bcisco.iosxe.accessListEntry","title":"Access list resolved from accessClassOut, restricting outbound connections initiated from the line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"endLine":{"name":"endLine","type":"\u0005","is_mandatory":true,"title":"Last VTY line number in the range","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"execTimeout":{"name":"execTimeout","type":"\t","is_mandatory":true,"title":"Idle timeout after which the EXEC session on the line is closed, unset when no timeout is configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputTransportTypes":{"name":"inputTransportTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Permitted inbound transport protocols, for example telnet and ssh; empty list denies all inbound connections","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loginAuthentication":{"name":"loginAuthentication","type":"\u001bcisco.iosxe.aaaAuthenticationLoginEntry","title":"Login authentication method list resolved from loginAuthenticationName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loginAuthenticationName":{"name":"loginAuthenticationName","type":"\u0007","is_mandatory":true,"title":"Name of the AAA login authentication method list applied to the line, empty when none is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputTransportTypes":{"name":"outputTransportTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Permitted outbound transport protocols, for example telnet and ssh","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"startLine":{"name":"startLine","type":"\u0005","is_mandatory":true,"title":"First VTY line number in the range","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XE virtual terminal line","desc":"Configuration of a VTY line range used for remote CLI access (Telnet and SSH), parsed from `show running-config all | sec vty`, including the inbound and outbound access-class ACLs, permitted input and output transports, EXEC timeout, and the login authentication method list. Useful for auditing remote-management exposure, for example restricting input transports to ssh and requiring an access-class. The startLine and endLine fields select the range.","private":true,"defaults":"startLine endLine accessClassIn inputTransportTypes","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr":{"id":"cisco.iosxr","name":"cisco.iosxr","fields":{"aaaAccounting":{"name":"aaaAccounting","type":"\u0019\u001bcisco.iosxr.aaaAccountingEntry","title":"AAA accounting method lists","desc":"Named accounting rules with the accounting logger type, logging method, and target server groups. Command: `show running-config aaa accounting`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aaaAccountingEntry":{"name":"aaaAccountingEntry","type":"\u001bcisco.iosxr.aaaAccountingEntry","title":"Cisco IOS XR AAA accounting rule","desc":"A single `aaa accounting` line, parsed from `show running-config aaa accounting`. Each rule names the activity audited, the method list, when records are emitted, and the server groups they are sent to.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"aaaAuthenticationLogin":{"name":"aaaAuthenticationLogin","type":"\u0019\u001bcisco.iosxr.aaaAuthenticationLoginEntry","title":"AAA login authentication method lists","desc":"Named authentication login lists and their ordered methods (for example `local`, `group tacacs+`, `enable`, `none`). Command: `show running-config formal | include aaa authentication login`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aaaAuthenticationLoginEntry":{"name":"aaaAuthenticationLoginEntry","type":"\u001bcisco.iosxr.aaaAuthenticationLoginEntry","title":"Cisco IOS XR AAA login authentication method list","desc":"A named (or default) authentication method list from aaa authentication login configuration, together with its ordered list of methods. The methodsGroups accessor breaks the raw method string into structured entries. Useful for auditing the authentication fallback chain (for example server group then local). The listName field selects the entry.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"aaaAuthorization":{"name":"aaaAuthorization","type":"\u0019\u001bcisco.iosxr.aaaAuthorizationEntry","title":"AAA authorization method lists","desc":"Named authorization rules with their type and target server groups. Command: `show running-config aaa authorization`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aaaAuthorizationEntry":{"name":"aaaAuthorizationEntry","type":"\u001bcisco.iosxr.aaaAuthorizationEntry","title":"Cisco IOS XR AAA authorization rule","desc":"A single `aaa authorization` line, parsed from `show running-config aaa authorization`. Each rule controls which activity a user is permitted to perform and the server groups consulted to make that decision. Command authorization on privileged sessions is a common control.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"aaaGroupServers":{"name":"aaaGroupServers","type":"\u0019\u001bcisco.iosxr.aaaGroupServersEntry","title":"AAA server groups","desc":"TACACS+ and RADIUS server groups with their member hosts, ports, and VRF. Command: `show running-config formal | include aaa group server`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"aaaGroupServersEntry":{"name":"aaaGroupServersEntry","type":"\u001bcisco.iosxr.aaaGroupServersEntry","title":"Cisco IOS XR AAA server group definition","desc":"A single `aaa group server` entry, parsed from `show running-config formal | include aaa group server`. Each entry names a TACACS+ or RADIUS server group, the member server, its ports, and any VRF. Server groups are referenced by authentication, authorization, and accounting method lists.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"aaaRadiusHostEntry":{"name":"aaaRadiusHostEntry","type":"\u001bcisco.iosxr.aaaRadiusHostEntry","title":"Cisco IOS XR AAA RADIUS server host","desc":"RADIUS server hosts parsed from the running config, used for AAA. Each entry gives the server address, authentication and accounting ports, and shared key with its encryption type. Use it to confirm RADIUS servers are defined and keys are not stored in clear text, for example `.where(keyType == 0)` to flag cleartext keys.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"aaaTacacsHostEntry":{"name":"aaaTacacsHostEntry","type":"\u001bcisco.iosxr.aaaTacacsHostEntry","title":"Cisco IOS XR AAA TACACS+ server host","desc":"TACACS+ server hosts parsed from the running config, used for AAA authentication, authorization, and accounting. Each entry gives the server address, port, and shared key with its encryption type. Use it to confirm TACACS+ servers are defined and keys are not stored in clear text, for example `.where(keyType == 0)` to flag cleartext keys.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"banner":{"name":"banner","type":"\u0019\u001bcisco.iosxr.bannerEntry","title":"Login and message banners","desc":"Configured banners with their type (for example motd, login, or exec) and text. Command: `show running-config banner`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bannerEntry":{"name":"bannerEntry","type":"\u001bcisco.iosxr.bannerEntry","title":"Cisco IOS XR banner","desc":"A single configured login-time banner parsed from `show running-config banner`. The type field distinguishes when the banner is shown and text holds its content. Useful for verifying that a required legal or authorized-use notice is present on login and EXEC sessions. The type field selects the banner.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"cdp":{"name":"cdp","type":"\u001bcisco.iosxr.cdpConf","title":"CDP configuration","desc":"Cisco Discovery Protocol state: whether CDP is disabled, its advertise frequency and holdtime, and whether CDPv2 advertisements are enabled. CDP leaks device details to neighbors and is often disabled for hardening. Command: `show cdp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cdpConf":{"name":"cdpConf","type":"\u001bcisco.iosxr.cdpConf","title":"Cisco IOS XR CDP global configuration","desc":"Global Cisco Discovery Protocol state reported by `show cdp`. CDP advertises device identity and capabilities to directly connected neighbors, which can leak topology information, so disabling it is a common hardening step. Reports whether CDP is disabled, the send frequency and holdtime timers, and whether CDPv2 advertisements are sent. Use it to confirm CDP is off where not needed, for example `.where(disabled == false)`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"cryptoKeyRsa":{"name":"cryptoKeyRsa","type":"\u001bcisco.iosxr.cryptoKeyRsa","title":"Cisco IOS XR router RSA public key","desc":"Router RSA key pair reported by `show crypto key mypubkey rsa`, used for SSH host identity and other crypto services. Reports the key label, type, modulus size, and creation date. Use it to require an adequate modulus, for example `.where(modulusSize \u003c 2048)` to flag weak keys.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"hostname":{"name":"hostname","type":"\u0007","title":"Hostname configured on the device","desc":"Command: `show running-config hostname`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.iosxr.interface","title":"Cisco IOS XR network interface","desc":"State of a single interface as reported by `show interfaces`, covering identity, operational status, hardware and encapsulation, addressing, and traffic and error counters. The `name` field selects the interface as it appears in the running device, for example `cisco.iosxr.interfaces.where(name == \"GigabitEthernet0/0/0/0\")`. All counter and rate fields are returned as strings exactly as parsed from the command output.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001bcisco.iosxr.interface","title":"Interfaces with their operational and configuration state","desc":"Per-interface admin and link status, hardware type, MAC address, IP address, MTU, bandwidth, speed, duplex, VLAN, and traffic counters. Command: `show interfaces`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inventory":{"name":"inventory","type":"\u0019\u001bcisco.ios.inventoryEntry","title":"Hardware inventory reported by `show inventory`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineAccounting":{"name":"lineAccounting","type":"\u0019\u001bcisco.iosxr.lineAccountingEntry","title":"Line accounting method lists","desc":"Per line the AAA accounting type and method list applied. Command: `show running-config formal | include accounting | include line`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineAccountingEntry":{"name":"lineAccountingEntry","type":"\u001bcisco.iosxr.lineAccountingEntry","title":"Cisco IOS XR line accounting binding","desc":"Association between a terminal line and an AAA accounting method list, parsed from the running configuration. Useful for verifying that command and EXEC session activity on management lines is accounted.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"lineAuthentication":{"name":"lineAuthentication","type":"\u0019\u001bcisco.iosxr.lineAuthenticationEntry","title":"Line login authentication method lists","desc":"Per line type (and VTY range) the AAA method list applied to login authentication. Command: `show running-config formal | include login authentication`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineAuthenticationEntry":{"name":"lineAuthenticationEntry","type":"\u001bcisco.iosxr.lineAuthenticationEntry","title":"Cisco IOS XR line login authentication binding","desc":"Association between a terminal line (console, default template, or a VTY range) and the AAA login authentication method list applied to it, parsed from the running configuration. Useful for confirming that management lines require AAA authentication.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"lineAuthorization":{"name":"lineAuthorization","type":"\u0019\u001bcisco.iosxr.lineAuthorizationEntry","title":"Line authorization method lists","desc":"Per line the AAA authorization type and method list applied. Command: `show running-config formal | include authorization | include line`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineAuthorizationEntry":{"name":"lineAuthorizationEntry","type":"\u001bcisco.iosxr.lineAuthorizationEntry","title":"Cisco IOS XR line authorization binding","desc":"Association between a terminal line and an AAA authorization method list, parsed from the running configuration. Useful for verifying that command or EXEC authorization is enforced on management lines.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"logging":{"name":"logging","type":"\u001bcisco.iosxr.loggingConfig","title":"Logging subsystem operational status","desc":"Whether syslog is enabled, dropped/flushed/overrun message counters, and the effective severity level and message count for each destination (console, monitor, trap, and buffer). Command: `show logging`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loggingConfig":{"name":"loggingConfig","type":"\u001bcisco.iosxr.loggingConfig","title":"Cisco IOS XR runtime logging counters and per-destination levels","desc":"Operational logging state parsed from the header of `show logging`, covering both the overall syslog process and each output destination. The enabled flag reflects whether the syslog logging process is running; dropped, flushes, and overruns are lifetime counters that signal message loss under load. For each destination (console, monitor, buffer, trap) it reports the active severity level and the number of messages logged so far. Use it to confirm logging is active and not silently dropping records, for example `.where(dropped == 0)`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"managementPlaneRules":{"name":"managementPlaneRules","type":"\u0019\u001bcisco.iosxr.runManagementPlaneRule","title":"Management plane protection rules","desc":"Management Plane Protection (MPP) rules that restrict which interfaces and protocols can manage the device. Command: `show running-config formal control-plane`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ntp":{"name":"ntp","type":"\u001bcisco.iosxr.ntpEntry","title":"NTP time synchronization configuration","desc":"Configured NTP servers, authentication keys and trusted keys, and the source interface used for time synchronization, plus whether NTP authentication is enabled. Command: `show running-config ntp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ntpEntry":{"name":"ntpEntry","type":"\u001bcisco.iosxr.ntpEntry","title":"Cisco IOS XR NTP configuration","desc":"Network Time Protocol settings parsed from `show running-config ntp`, including authentication state, defined authentication keys, configured time servers, the source interface, and the set of trusted keys. Useful for auditing whether NTP authentication is enforced and time sources are restricted to trusted, authenticated servers.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"passwordPolicies":{"name":"passwordPolicies","type":"\u0019\u001bcisco.iosxr.passwordPolicy","title":"AAA password policies","desc":"Named password-policy rules with password lifetime, minimum length, required character changes, and numeric/special-character composition requirements. Command: `show running-config aaa password-policy`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordPolicy":{"name":"passwordPolicy","type":"\u001bcisco.iosxr.passwordPolicy","title":"Cisco IOS XR password policy","desc":"A named AAA password policy parsed from `show running-config aaa password-policy`, defining password lifetime, minimum length, minimum required character change, and minimum counts of numeric and special characters. Useful for verifying password-strength requirements. The name field selects the policy.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"routerBgp":{"name":"routerBgp","type":"\u0019\u001bcisco.iosxr.runRouterBgpEntry","title":"BGP router configuration","desc":"BGP configuration from the running config. Command: `show running-config router bgp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerEigrp":{"name":"routerEigrp","type":"\u0019\u001bcisco.iosxr.runRouterEigrpEntry","title":"EIGRP router configuration","desc":"EIGRP autonomous systems with their address families and per-interface authentication key chains. Command: `show running-config router eigrp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerHsrp":{"name":"routerHsrp","type":"\u0019\u001bcisco.iosxr.runRouterHsrpEntry","title":"HSRP router configuration","desc":"Hot Standby Router Protocol configuration from the running config. Command: `show running-config router hsrp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerIsis":{"name":"routerIsis","type":"\u0019\u001bcisco.iosxr.runRouterIsisEntry","title":"IS-IS router configuration","desc":"IS-IS configuration from the running config. Command: `show running-config router isis`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerOspfAreas":{"name":"routerOspfAreas","type":"\u0019\u001bcisco.iosxr.runRouterOspfArea","title":"OSPF router configuration","desc":"OSPF areas from the running config. Command: `show running-config router ospf`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerPublicKey":{"name":"routerPublicKey","type":"\u001bcisco.iosxr.cryptoKeyRsa","title":"Router RSA public key","desc":"The device's RSA public key with its label, key type, modulus size in bits, and creation date. Command: `show crypto key mypubkey rsa`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerRipInterfaces":{"name":"routerRipInterfaces","type":"\u0019\u001bcisco.iosxr.runRouterRipInterface","title":"RIP interface configuration","desc":"RIP-enabled interfaces from the running config. Command: `show running-config router rip`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerVrrp":{"name":"routerVrrp","type":"\u0019\u001bcisco.iosxr.runRouterVrrpEntry","title":"VRRP router configuration","desc":"Virtual Router Redundancy Protocol configuration from the running config. Command: `show running-config router vrrp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runAaaRadiusHosts":{"name":"runAaaRadiusHosts","type":"\u0019\u001bcisco.iosxr.aaaRadiusHostEntry","title":"AAA RADIUS hosts","desc":"RADIUS servers with their host, authentication and accounting ports, key encryption type, and key. Command: `show running-config aaa` (only the radius hosts part is parsed)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runAaaTacacsHosts":{"name":"runAaaTacacsHosts","type":"\u0019\u001bcisco.iosxr.aaaTacacsHostEntry","title":"AAA TACACS+ hosts","desc":"TACACS+ servers with their host, port, key encryption type, and key. Command: `show running-config aaa` (only the tacacs+ hosts part is parsed)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runConsoleExecTimeout":{"name":"runConsoleExecTimeout","type":"\u001bcisco.iosxr.runConsoleExecTimeoutEntry","title":"Console line idle exec-timeout","desc":"Idle timeout (minutes and seconds) after which a console session is logged out. A zero timeout disables automatic logout and is a hardening concern. Command: `show running-config formal | include console exec-timeout`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runConsoleExecTimeoutEntry":{"name":"runConsoleExecTimeoutEntry","type":"\u001bcisco.iosxr.runConsoleExecTimeoutEntry","title":"Cisco IOS XR console exec-timeout configuration","desc":"Idle exec-timeout configured on the console line, parsed from the running config. A value of 0 minutes and 0 seconds disables the timeout so a console session never logs out, a common hardening finding. Use it to require a non-zero timeout, for example `.where(minutes == 0 \u0026\u0026 seconds == 0)` to flag disabled timeouts.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runKeyChainEntry":{"name":"runKeyChainEntry","type":"\u001bcisco.iosxr.runKeyChainEntry","title":"Key chain key entry from running config","desc":"One key within a key chain, identified by chain name and key index, with its key string used to authenticate routing protocols.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runKeyChains":{"name":"runKeyChains","type":"\u0019\u001bcisco.iosxr.runKeyChainEntry","title":"Key chains","desc":"Configured key chains with their keys, used to authenticate routing protocols. Command: `show running-config formal key chain`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runLineAcl":{"name":"runLineAcl","type":"\u001bcisco.iosxr.runLineAcl","title":"Line access-class configuration from running config","desc":"Access-lists bound to a line template that restrict which sources may open a session on it. Select the line with the `lineTemplate` argument (for example `default`), then read `acl` for the applied access-classes. Command: `show running-config formal | include line \u003clineTemplate\u003e access-class`","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runLineAclEntry":{"name":"runLineAclEntry","type":"\u001bcisco.iosxr.runLineAclEntry","title":"Line access-class entry from running config","desc":"One access-class bound to a line template, giving the traffic direction it filters and the access-list name.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runLineTransportIO":{"name":"runLineTransportIO","type":"\u001bcisco.iosxr.runLineTransportIO","title":"Line transport-input/output configuration from running config","desc":"Transport protocols allowed inbound and outbound on a line template. Select the line with the `lineTemplate` argument (for example `default` or `ssh-only-config`), then read `entries` for the per-direction protocols. Command: `show running-config formal | include line \u003clineTemplate\u003e transport`","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runLineTransportIOEntry":{"name":"runLineTransportIOEntry","type":"\u001bcisco.iosxr.runLineTransportIOEntry","title":"Line transport-input/output entry from running config","desc":"One transport direction on a line template and the protocols permitted on it, for example inbound `ssh` only.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runLogging":{"name":"runLogging","type":"\u001bcisco.iosxr.runLoggingConfig","title":"Logging configuration","desc":"Configured severity level and buffer size for each logging destination (console, monitor, trap, and buffered), plus the logging source interface. Command: `show running-config logging`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runLoggingConfig":{"name":"runLoggingConfig","type":"\u001bcisco.iosxr.runLoggingConfig","title":"Cisco IOS XR configured logging destinations and source interface","desc":"Logging configuration parsed from `show running-config logging`, giving the intended (not runtime) settings for each destination. For console, monitor, buffer, and trap it reports the configured severity level and, where set, the buffer or file size in bytes. The sourceInterface field names the interface whose address is used as the source of outbound syslog messages. Use it to audit that log levels and a stable logging source are configured, for example `.where(bufferLogLevel != \"\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runLoggingSyslogHost":{"name":"runLoggingSyslogHost","type":"\u001bcisco.iosxr.runLoggingSyslogHost","title":"Cisco IOS XR syslog remote host configuration","desc":"Remote syslog destinations parsed from `show running-config logging`. Each entry names a receiver and, where set, the destination port, per-host severity level, and VRF used to reach it. Use it to confirm logs are forwarded to a central collector, for example `cisco.iosxr.runLoggingSyslogHosts.length \u003e 0`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runLoggingSyslogHosts":{"name":"runLoggingSyslogHosts","type":"\u0019\u001bcisco.iosxr.runLoggingSyslogHost","title":"Configured remote syslog hosts","desc":"Remote syslog servers with their destination port, VRF, and severity filter. Command: `show running-config logging`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runManagementPlaneRule":{"name":"runManagementPlaneRule","type":"\u001bcisco.iosxr.runManagementPlaneRule","title":"Cisco IOS XR management-plane protection rule","desc":"A single allow, deny, or none rule from `control-plane management-plane`, which restricts the protocols and peers that may reach the router's management plane over inband (data) or out-of-band (dedicated management) interfaces. Parsed from `show running-config formal control-plane`. Use it to verify management access is locked down to expected protocols and peer addresses.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterBgpEntry":{"name":"runRouterBgpEntry","type":"\u001bcisco.iosxr.runRouterBgpEntry","title":"BGP routing process in a Cisco IOS XR running config","desc":"A `router bgp` instance in the running config, identified by its Autonomous System (AS) number, together with its configured neighbors. Parsed from `show running-config router bgp`. Selected by AS number; use it to audit BGP peering, including session passwords and shutdown state.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterBgpNeighbor":{"name":"runRouterBgpNeighbor","type":"\u001bcisco.iosxr.runRouterBgpNeighbor","title":"BGP neighbor in a Cisco IOS XR running config","desc":"A single BGP peer configured under a `router bgp` instance, exposing its remote AS, session password, description, update source, multihop setting, and administrative shutdown state. Use it to verify that eBGP sessions are authenticated and that stale neighbors are shut down.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterEigrpAddressFamily":{"name":"runRouterEigrpAddressFamily","type":"\u001bcisco.iosxr.runRouterEigrpAddressFamily","title":"EIGRP address family within a Cisco IOS XR EIGRP process","desc":"An IPv4 or IPv6 address family configured under a `router eigrp` instance in the running config, along with the interfaces enrolled in it and their EIGRP packet authentication. Parsed from `show running-config router eigrp`. Use it to confirm that EIGRP adjacencies authenticate their protocol packets with a key chain.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterEigrpAddressFamilyInterface":{"name":"runRouterEigrpAddressFamilyInterface","type":"\u001bcisco.iosxr.runRouterEigrpAddressFamilyInterface","title":"Interface enrolled in a Cisco IOS XR EIGRP address family","desc":"A single interface configured under an EIGRP address family in the running config, exposing whether EIGRP packets on that interface are authenticated with a key chain (`authentication keychain \u003cname\u003e`).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterEigrpEntry":{"name":"runRouterEigrpEntry","type":"\u001bcisco.iosxr.runRouterEigrpEntry","title":"Cisco IOS XR EIGRP routing process","desc":"EIGRP router instances parsed from `show running-config router eigrp`. Each instance is identified by its autonomous system number and exposes the configured address families. Selection is by the AS number, and the addressFamilies field carries the per-family configuration including interfaces and their authentication key chains.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterHsrpEntry":{"name":"runRouterHsrpEntry","type":"\u001bcisco.iosxr.runRouterHsrpEntry","title":"HSRP group on a Cisco IOS XR interface","desc":"A Hot Standby Router Protocol group configured under an interface's address family in the running config, exposing its group number and authentication string. Parsed from `show running-config router hsrp`. Use it to confirm first-hop redundancy groups are authenticated.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterIsisEntry":{"name":"runRouterIsisEntry","type":"\u001bcisco.iosxr.runRouterIsisEntry","title":"IS-IS routing process in a Cisco IOS XR running config","desc":"A `router isis` instance in the running config, identified by its process name (tag), with its link-state PDU authentication key chain and the interfaces enabled for the process. Parsed from `show running-config router isis`. Use it to confirm that IS-IS LSPs and hellos are authenticated with key chains.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterIsisInterface":{"name":"runRouterIsisInterface","type":"\u001bcisco.iosxr.runRouterIsisInterface","title":"Interface enabled for a Cisco IOS XR IS-IS process","desc":"A single interface configured under an IS-IS instance, exposing the key chain that authenticates IS-IS hello PDUs on that interface (`hello-password keychain \u003cname\u003e`).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterOspfArea":{"name":"runRouterOspfArea","type":"\u001bcisco.iosxr.runRouterOspfArea","title":"OSPF area within a Cisco IOS XR OSPF process","desc":"A single OSPF area configured under a `router ospf` process in the running config, with its address family and its authentication (a key chain and/or a message-digest MD5 key). Parsed from `show running-config router ospf`. Use it to confirm that OSPF areas authenticate adjacencies rather than running with authentication off.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterRipInterface":{"name":"runRouterRipInterface","type":"\u001bcisco.iosxr.runRouterRipInterface","title":"Interface running RIP in a Cisco IOS XR running config","desc":"A single interface configured under `router rip`, exposing the key chain and mode used to authenticate RIP updates on that interface. Parsed from `show running-config router rip`. Use it to confirm RIP interfaces authenticate updates with MD5 rather than plain text.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRouterVrrpEntry":{"name":"runRouterVrrpEntry","type":"\u001bcisco.iosxr.runRouterVrrpEntry","title":"VRRP group on a Cisco IOS XR interface","desc":"A Virtual Router Redundancy Protocol group configured under an interface's address family in the running config, exposing its group number and any plain-text authentication string. Parsed from `show running-config router vrrp`. Use it to flag VRRP groups relying on weak plain-text authentication.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runSnmpCommunities":{"name":"runSnmpCommunities","type":"\u0019\u001bcisco.iosxr.runSnmpCommunitiesEntry","title":"SNMP community strings","desc":"Configured SNMP communities with their access privilege, address family, and any applied access-list. World-readable or writable communities are a hardening concern. Command: `show running-config snmp-server | include snmp-server community`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runSnmpCommunitiesEntry":{"name":"runSnmpCommunitiesEntry","type":"\u001bcisco.iosxr.runSnmpCommunitiesEntry","title":"Cisco IOS XR SNMPv1/v2c community string configuration","desc":"SNMP community strings parsed from `snmp-server community` lines in the running config, the shared-secret access control for SNMPv1 and SNMPv2c. Each entry pairs a community name with its access privilege, address family, and optional access-list restricting which managers may use it. Use it to flag weak or overly permissive community strings, for example `.where(community == \"public\" || privilege == \"RW\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runSnmpGroups":{"name":"runSnmpGroups","type":"\u0019\u001bcisco.iosxr.runSnmpGroupsEntry","title":"SNMP groups","desc":"Configured SNMP groups with their version, v3 privacy level, IP version, and applied access-list. Command: `show running-config | include snmp-server group`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runSnmpGroupsEntry":{"name":"runSnmpGroupsEntry","type":"\u001bcisco.iosxr.runSnmpGroupsEntry","title":"Cisco IOS XR SNMP access group configuration","desc":"SNMP groups parsed from `snmp-server group` lines in the running config, mapping a group to its SNMP version, security level, and access-list. Views and permissions bound to the group govern what its members may read or write. Use it to review v3 groups that lack authentication and privacy, for example `.where(version == \"3\" \u0026\u0026 v3PrivacyLevel != \"priv\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runSnmpHosts":{"name":"runSnmpHosts","type":"\u0019\u001bcisco.iosxr.runSnmpHostsEntry","title":"SNMP notification hosts","desc":"Configured SNMP trap/inform recipients with their address, notification type, version, and (for v3) security level and user. Command: `show running-config | include snmp-server host`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runSnmpHostsEntry":{"name":"runSnmpHostsEntry","type":"\u001bcisco.iosxr.runSnmpHostsEntry","title":"Cisco IOS XR SNMP notification host configuration","desc":"SNMP trap and inform destinations parsed from `snmp-server host` lines in the running config. Each entry names a receiver and the protocol version, community or user, and security level used to send notifications to it. Use it to confirm notifications go only to intended collectors and, for SNMPv3, use an authenticated and encrypted security level, for example `.where(version == \"3\" \u0026\u0026 v3SecurityLevel == \"priv\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runSnmpUsers":{"name":"runSnmpUsers","type":"\u0019\u001bcisco.iosxr.runSnmpUsersEntry","title":"SNMP users from running config","desc":"Configured SNMPv3 users with their group, version, authentication and privacy protocols and keys, and applied access-list. Command: `show running-config | include snmp-server user`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runSnmpUsersEntry":{"name":"runSnmpUsersEntry","type":"\u001bcisco.iosxr.runSnmpUsersEntry","title":"Cisco IOS XR SNMPv3 user configuration","desc":"SNMPv3 users parsed from `snmp-server user` lines in the running config, including group membership and the authentication and privacy protocols and keys. Use it to verify every v3 user has strong authentication and privacy configured and is not stored with weak algorithms, for example `.where(v3AuthProtocol == \"sha\" \u0026\u0026 v3PrivProtocol == \"aes\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runSshVrfAccessListEntry":{"name":"runSshVrfAccessListEntry","type":"\u001bcisco.iosxr.runSshVrfAccessListEntry","title":"SSH VRF access-list entry from running config","desc":"One access-list restricting SSH for a given side, VRF, and protocol.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runSshVrfAccessLists":{"name":"runSshVrfAccessLists","type":"\u0019\u001bcisco.iosxr.runSshVrfAccessListEntry","title":"SSH VRF access-lists","desc":"Access-lists restricting SSH by side (server/client), VRF, and protocol (IPv4/IPv6). Command: `show running-config formal | include ssh.*access-list`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"smallServer":{"name":"smallServer","type":"\u001bcisco.iosxr.smallServer","title":"Cisco IOS XR small servers configuration","desc":"State of the minor TCP and UDP small servers (echo, discard, chargen, daytime) enabled by service tcp-small-servers or service udp-small-servers. Presence of these servers is a hardening concern. The protocol field selects the entry.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"smallServers":{"name":"smallServers","type":"\u0019\u001bcisco.iosxr.smallServer","title":"TCP and UDP small-servers configuration","desc":"Whether the small servers (echo, discard, chargen, daytime) are enabled per protocol and IP version, and the configured maximum server count. These legacy services are a hardening concern and should normally be disabled. Command: `show running-config | include small`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"snmpUsers":{"name":"snmpUsers","type":"\u0019\u001bcisco.iosxr.snmpUsersEntry","title":"SNMP users","desc":"Operational SNMPv3 users with their storage type and engine ID. Command: `show snmp user`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"snmpUsersEntry":{"name":"snmpUsersEntry","type":"\u001bcisco.iosxr.snmpUsersEntry","title":"Cisco IOS XR SNMP users from show snmp user","desc":"SNMPv3 users as reported operationally by `show snmp user`, giving the runtime view (username, storage type, and SNMP engine ID) rather than the configured credentials. Complements cisco.iosxr.runSnmpUsersEntry, which parses the running config.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ssh":{"name":"ssh","type":"\u001bcisco.iosxr.sshConfig","title":"SSH server configuration","desc":"SSH session timeout, negotiated protocol version, and the VRFs the SSH and NETCONF servers listen on. Command: `show running-config ssh`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sshConfig":{"name":"sshConfig","type":"\u001bcisco.iosxr.sshConfig","title":"Cisco IOS XR SSH server configuration","desc":"SSH server settings, parsed from `show running-config ssh`. Covers the enforced protocol version, the authentication negotiation timeout, and the VRFs the SSH and NETCONF-over-SSH servers listen on. Confirming the server is pinned to SSHv2 is a baseline hardening check.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"type6":{"name":"type6","type":"\u001bcisco.iosxr.type6serverConfig","title":"Type 6 password encryption server state","desc":"Status of the AES-based Type 6 password encryption feature: whether the master key and AES are configured, whether the feature is enabled, and whether a master-key operation is in progress. Command: `show type6 server`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type6serverConfig":{"name":"type6serverConfig","type":"\u001bcisco.iosxr.type6serverConfig","title":"Cisco IOS XR Type 6 password encryption state","desc":"Status of the AES-based Type 6 password encryption feature as reported by `show type6 server`, including whether AES encryption and the master key are configured, whether a master key operation is in progress, and the overall feature state. Useful for confirming that reversible stored secrets are protected by Type 6 encryption.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"user":{"name":"user","type":"\u001bcisco.iosxr.user","title":"Cisco IOS XR local user account","desc":"A locally defined user account parsed from `show running-config username`, including group membership and the stored secret and password material with their encoding types. Useful for auditing account privilege (via groups) and detecting weak password storage. Select by username, for example `cisco.iosxr.users.where(username == \"admin\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bcisco.iosxr.user","title":"Local user accounts with the group membership, password, and encryption level of each","desc":"Command: `show running-config username`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vtyLines":{"name":"vtyLines","type":"\u0019\u001bcisco.iosxr.vtyLinesEntry","title":"VTY pools","desc":"VTY line pools with their line-number range and the line template applied to them. Command: `show running-config formal | include vty-pool`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vtyLinesEntry":{"name":"vtyLinesEntry","type":"\u001bcisco.iosxr.vtyLinesEntry","title":"Cisco IOS XR VTY pool definition","desc":"A single `vty-pool` entry, parsed from `show running-config formal | include vty-pool`. A VTY pool reserves a contiguous range of virtual terminal lines and binds them to a line template, which carries the exec-timeout, transport, access-class, and authentication settings for remote sessions in that pool.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"title":"Cisco IOS XR network operating system","desc":"Configuration and operational state of a device running Cisco IOS XR, collected by running `show` commands over the device connection. Fields cover the hostname and interfaces, AAA (authentication, authorization, and accounting), SNMP, NTP, logging, SSH and crypto keys, CDP, password policies, line and VTY settings, and the routing protocols (BGP, OSPF, EIGRP, ISIS, RIP, VRRP, HSRP). Each field notes the `show` command it comes from. Use it to audit the hardening of an IOS XR router or switch.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaAccountingEntry":{"id":"cisco.iosxr.aaaAccountingEntry","name":"cisco.iosxr.aaaAccountingEntry","fields":{"listName":{"name":"listName","type":"\u0007","is_mandatory":true,"title":"Named accounting rule","desc":"Name of the method list (`default` applies unless a named list is attached to a line or interface).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loggerType":{"name":"loggerType","type":"\u0007","is_mandatory":true,"title":"Activity being accounted","desc":"One of exec (EXEC/shell sessions), commands (CLI commands), network (network services), or system (system events), among others.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loggingMethod":{"name":"loggingMethod","type":"\u0007","is_mandatory":true,"title":"When accounting records are generated","desc":"start-stop sends a start record at the beginning and a stop record at the end, stop-only sends only a stop record, and none disables accounting.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"targetGroup":{"name":"targetGroup","type":"\u001bcisco.iosxr.aaaAccountingEntry.targetGroup","title":"Cisco IOS XR AAA accounting target token","desc":"A single target parsed from an accounting rule's method tokens. name holds the token and local flags the local method.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"targets":{"name":"targets","type":"\u0007","is_mandatory":true,"title":"Raw server-group tokens the records are sent to","desc":"Unparsed remainder of the line, for example \"group tacacs_group local\". Use targetsGroups for the structured breakdown.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"targetsGroups":{"name":"targetsGroups","type":"\u0019\u001bcisco.iosxr.aaaAccountingEntry.targetGroup","title":"Structured targets parsed from the targets string","desc":"One entry per token, distinguishing server-group references from the local method.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA accounting rule","desc":"A single `aaa accounting` line, parsed from `show running-config aaa accounting`. Each rule names the activity audited, the method list, when records are emitted, and the server groups they are sent to.","private":true,"defaults":"listName loggerType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaAccountingEntry.targetGroup":{"id":"cisco.iosxr.aaaAccountingEntry.targetGroup","name":"cisco.iosxr.aaaAccountingEntry.targetGroup","fields":{"local":{"name":"local","type":"\u0004","is_mandatory":true,"title":"Whether this target is the local method","desc":"True for the `local` (and `local-case`) token; false for group references and other keywords.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Target token name","desc":"The server-group name for a `group \u003cname\u003e` target (for example tacacs_example), or the literal method keyword otherwise.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA accounting target token","desc":"A single target parsed from an accounting rule's method tokens. name holds the token and local flags the local method.","private":true,"defaults":"name local","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaAuthenticationLoginEntry":{"id":"cisco.iosxr.aaaAuthenticationLoginEntry","name":"cisco.iosxr.aaaAuthenticationLoginEntry","fields":{"listName":{"name":"listName","type":"\u0007","is_mandatory":true,"title":"Method-list name, either default or a named list referenced by lines and interfaces","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methodGroup":{"name":"methodGroup","type":"\u001bcisco.iosxr.aaaAuthenticationLoginEntry.methodGroup","title":"Cisco IOS XR AAA login authentication method group","desc":"A single method within an authentication login method list, either a named server group or a built-in method such as local. Distinguishing local from remote server groups helps audit whether a fallback to local credentials exists.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"methods":{"name":"methods","type":"\u0007","is_mandatory":true,"title":"Ordered, space-separated method string as configured, for example \"group tacacs+ local\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methodsGroups":{"name":"methodsGroups","type":"\u0019\u001bcisco.iosxr.aaaAuthenticationLoginEntry.methodGroup","title":"Structured breakdown of the methods string into individual method groups","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA login authentication method list","desc":"A named (or default) authentication method list from aaa authentication login configuration, together with its ordered list of methods. The methodsGroups accessor breaks the raw method string into structured entries. Useful for auditing the authentication fallback chain (for example server group then local). The listName field selects the entry.","private":true,"defaults":"listName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaAuthenticationLoginEntry.methodGroup":{"id":"cisco.iosxr.aaaAuthenticationLoginEntry.methodGroup","name":"cisco.iosxr.aaaAuthenticationLoginEntry.methodGroup","fields":{"local":{"name":"local","type":"\u0004","is_mandatory":true,"title":"Whether this method is local (or local-case) rather than a named server group","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Method token, for example a server group name, local, enable, none, or line","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA login authentication method group","desc":"A single method within an authentication login method list, either a named server group or a built-in method such as local. Distinguishing local from remote server groups helps audit whether a fallback to local credentials exists.","private":true,"defaults":"name local","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaAuthorizationEntry":{"id":"cisco.iosxr.aaaAuthorizationEntry","name":"cisco.iosxr.aaaAuthorizationEntry","fields":{"listName":{"name":"listName","type":"\u0007","is_mandatory":true,"title":"Named authorization rule","desc":"Name of the method list (`default` applies unless a named list is attached).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"targetGroup":{"name":"targetGroup","type":"\u001bcisco.iosxr.aaaAuthorizationEntry.targetGroup","title":"Cisco IOS XR AAA authorization target token","desc":"A single target parsed from an authorization rule's method tokens. name holds the token and local flags the local method.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"targets":{"name":"targets","type":"\u0007","is_mandatory":true,"title":"Raw server-group tokens consulted for authorization","desc":"Unparsed remainder of the line, for example \"group tacacs_group local\". Use targetsGroups for the structured breakdown.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"targetsGroups":{"name":"targetsGroups","type":"\u0019\u001bcisco.iosxr.aaaAuthorizationEntry.targetGroup","title":"Structured targets parsed from the targets string","desc":"One entry per token, distinguishing server-group references from the local method.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Activity being authorized","desc":"One of exec (starting an EXEC session), commands (EXEC-mode commands), network (network services such as IKE), or eventmanager (Embedded Event Manager actions).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA authorization rule","desc":"A single `aaa authorization` line, parsed from `show running-config aaa authorization`. Each rule controls which activity a user is permitted to perform and the server groups consulted to make that decision. Command authorization on privileged sessions is a common control.","private":true,"defaults":"listName type","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaAuthorizationEntry.targetGroup":{"id":"cisco.iosxr.aaaAuthorizationEntry.targetGroup","name":"cisco.iosxr.aaaAuthorizationEntry.targetGroup","fields":{"local":{"name":"local","type":"\u0004","is_mandatory":true,"title":"Whether this target is the local method","desc":"True for the `local` (and `local-case`) token; false for group references and other keywords.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Target token name","desc":"The server-group name for a `group \u003cname\u003e` target (for example tacacs_example), or the literal method keyword otherwise.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA authorization target token","desc":"A single target parsed from an authorization rule's method tokens. name holds the token and local flags the local method.","private":true,"defaults":"name local","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaGroupServersEntry":{"id":"cisco.iosxr.aaaGroupServersEntry","name":"cisco.iosxr.aaaGroupServersEntry","fields":{"groupName":{"name":"groupName","type":"\u0007","is_mandatory":true,"title":"Name of the AAA server group","desc":"Referenced by AAA method lists elsewhere in the configuration.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol of the server group","desc":"Either tacacs+ or radius.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"radiusAcctPort":{"name":"radiusAcctPort","type":"\u0005","is_mandatory":true,"title":"RADIUS server accounting port","desc":"UDP port from `acct-port \u003cn\u003e` for a radius group. Null for TACACS+ groups and when unset (RADIUS default 1646 or 1813).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"radiusAuthPort":{"name":"radiusAuthPort","type":"\u0005","is_mandatory":true,"title":"RADIUS server authentication port","desc":"UDP port from `auth-port \u003cn\u003e` for a radius group. Null for TACACS+ groups and when unset (RADIUS default 1645 or 1812).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"serverHost":{"name":"serverHost","type":"\u0007","is_mandatory":true,"title":"IP address or hostname of a member server","desc":"The server added to the group with the `server` subcommand. Empty on group lines that carry only the VRF binding.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"tacacsServerPort":{"name":"tacacsServerPort","type":"\u0005","is_mandatory":true,"title":"TACACS+ server port","desc":"TCP port from `server \u003chost\u003e port \u003cn\u003e` for a tacacs+ group. Null for RADIUS groups and when no explicit port is set (TACACS+ default 49).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrfInstanceName":{"name":"vrfInstanceName","type":"\u0007","is_mandatory":true,"title":"VRF the server group operates in","desc":"VRF name from the group's `vrf` binding. Empty when the group uses the default (global) routing table.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA server group definition","desc":"A single `aaa group server` entry, parsed from `show running-config formal | include aaa group server`. Each entry names a TACACS+ or RADIUS server group, the member server, its ports, and any VRF. Server groups are referenced by authentication, authorization, and accounting method lists.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaRadiusHostEntry":{"id":"cisco.iosxr.aaaRadiusHostEntry","name":"cisco.iosxr.aaaRadiusHostEntry","fields":{"acctPort":{"name":"acctPort","type":"\u0005","is_mandatory":true,"title":"RADIUS accounting port","desc":"UDP port for accounting; the Cisco default is 1646 (the RFC-standard port is 1813).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authPort":{"name":"authPort","type":"\u0005","is_mandatory":true,"title":"RADIUS authentication port","desc":"UDP port for authentication and authorization; the Cisco default is 1645 (the RFC-standard port is 1812).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"RADIUS server hostname or IP address","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"RADIUS shared secret key","desc":"Stored shared secret, encrypted with the Cisco type-7 scheme when keyType is 7 and in clear text when keyType is 0.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyType":{"name":"keyType","type":"\u0005","is_mandatory":true,"title":"Shared-key encryption type","desc":"Cisco encryption type of the stored key: 0 for clear text or 7 for the reversible Cisco type-7 scheme. Neither protects the key at rest; type 7 is trivially decryptable.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA RADIUS server host","desc":"RADIUS server hosts parsed from the running config, used for AAA. Each entry gives the server address, authentication and accounting ports, and shared key with its encryption type. Use it to confirm RADIUS servers are defined and keys are not stored in clear text, for example `.where(keyType == 0)` to flag cleartext keys.","private":true,"defaults":"host authPort acctPort keyType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.aaaTacacsHostEntry":{"id":"cisco.iosxr.aaaTacacsHostEntry","name":"cisco.iosxr.aaaTacacsHostEntry","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"TACACS+ server hostname or IP address","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"TACACS+ shared secret key","desc":"Stored shared secret, encrypted with the Cisco type-7 scheme when keyType is 7 and in clear text when keyType is 0.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyType":{"name":"keyType","type":"\u0005","is_mandatory":true,"title":"Shared-key encryption type","desc":"Cisco encryption type of the stored key: 0 for clear text or 7 for the reversible Cisco type-7 scheme. Neither protects the key at rest; type 7 is trivially decryptable.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"TACACS+ server TCP port","desc":"Port the server listens on; the default is 49.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR AAA TACACS+ server host","desc":"TACACS+ server hosts parsed from the running config, used for AAA authentication, authorization, and accounting. Each entry gives the server address, port, and shared key with its encryption type. Use it to confirm TACACS+ servers are defined and keys are not stored in clear text, for example `.where(keyType == 0)` to flag cleartext keys.","private":true,"defaults":"host port keyType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.bannerEntry":{"id":"cisco.iosxr.bannerEntry","name":"cisco.iosxr.bannerEntry","fields":{"text":{"name":"text","type":"\u0007","is_mandatory":true,"title":"Banner message content, with multi-line banners joined by newlines","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Banner type","desc":"One of exec (shown when an EXEC process starts), incoming (shown on reverse-Telnet sessions), login (shown before authentication), motd (message of the day), prompt-timeout (shown on login authentication timeout), or slip-ppp (shown on SLIP or PPP connections).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR banner","desc":"A single configured login-time banner parsed from `show running-config banner`. The type field distinguishes when the banner is shown and text holds its content. Useful for verifying that a required legal or authorized-use notice is present on login and EXEC sessions. The type field selects the banner.","private":true,"defaults":"type","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.cdpConf":{"id":"cisco.iosxr.cdpConf","name":"cisco.iosxr.cdpConf","fields":{"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether CDP is globally disabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"frequencyString":{"name":"frequencyString","type":"\u0007","is_mandatory":true,"title":"CDP packet send frequency","desc":"Interval between CDP advertisements as reported by the device, e.g. \"60 seconds\" (the default).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"holdtimeString":{"name":"holdtimeString","type":"\u0007","is_mandatory":true,"title":"CDP holdtime","desc":"How long a neighbor retains received CDP information before discarding it, e.g. \"180 seconds\" (the default).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v2AdvertisementsEnabled":{"name":"v2AdvertisementsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether CDPv2 advertisements are enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR CDP global configuration","desc":"Global Cisco Discovery Protocol state reported by `show cdp`. CDP advertises device identity and capabilities to directly connected neighbors, which can leak topology information, so disabling it is a common hardening step. Reports whether CDP is disabled, the send frequency and holdtime timers, and whether CDPv2 advertisements are sent. Use it to confirm CDP is off where not needed, for example `.where(disabled == false)`.","private":true,"defaults":"disabled frequencyString","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.cryptoKeyRsa":{"id":"cisco.iosxr.cryptoKeyRsa","name":"cisco.iosxr.cryptoKeyRsa","fields":{"creationDate":{"name":"creationDate","type":"\u0007","is_mandatory":true,"title":"Key creation date as reported by the device","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Key label","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"modulusSize":{"name":"modulusSize","type":"\u0005","is_mandatory":true,"title":"Modulus size in bits","desc":"RSA key length, e.g. 512, 768, 1024, 2048, or 4096. Keys below 2048 bits are considered weak.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Key type, e.g. RSA","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR router RSA public key","desc":"Router RSA key pair reported by `show crypto key mypubkey rsa`, used for SSH host identity and other crypto services. Reports the key label, type, modulus size, and creation date. Use it to require an adequate modulus, for example `.where(modulusSize \u003c 2048)` to flag weak keys.","private":true,"defaults":"label type modulusSize","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.interface":{"id":"cisco.iosxr.interface","name":"cisco.iosxr.interface","fields":{"abort":{"name":"abort","type":"\u0007","is_mandatory":true,"title":"Count of aborted inbound frames","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"adminState":{"name":"adminState","type":"\u0007","is_mandatory":true,"title":"Line protocol status","desc":"Status reported after \"line protocol is\" in the show interfaces output, reflecting the operational (protocol) state. Typically up or down.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bandwidth":{"name":"bandwidth","type":"\u0007","is_mandatory":true,"title":"Configured bandwidth with its unit as printed by the device (for example \"1000000 Kbit\")","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bia":{"name":"bia","type":"\u0007","is_mandatory":true,"title":"Burned-in address (permanent hardware MAC), which differs from macAddress when a MAC override is configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"crc":{"name":"crc","type":"\u0007","is_mandatory":true,"title":"Count of inbound frames failing the cyclic redundancy check","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form interface description configured with the description command, empty when none is set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"duplex":{"name":"duplex","type":"\u0007","is_mandatory":true,"title":"Duplex setting, Full or Half","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encapsulation":{"name":"encapsulation","type":"\u0007","is_mandatory":true,"title":"Layer 2 encapsulation","desc":"Encapsulation configured on the interface, for example ARPA, 802.1Q Virtual LAN, or Loopback.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"frame":{"name":"frame","type":"\u0007","is_mandatory":true,"title":"Count of inbound framing errors (misaligned frames)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"giants":{"name":"giants","type":"\u0007","is_mandatory":true,"title":"Count of giants, frames larger than the maximum allowed size","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hardwareType":{"name":"hardwareType","type":"\u0007","is_mandatory":true,"title":"Hardware type","desc":"Interface hardware or media type, for example GigE, TenGigE, HundredGigE, Management Ethernet, Loopback, or Null.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputErrors":{"name":"inputErrors","type":"\u0007","is_mandatory":true,"title":"Total inbound errors since counters were last cleared","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputPackets":{"name":"inputPackets","type":"\u0007","is_mandatory":true,"title":"Total packets received since counters were last cleared","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputPps":{"name":"inputPps","type":"\u0007","is_mandatory":true,"title":"Five-minute average inbound packet rate in packets per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputRate":{"name":"inputRate","type":"\u0007","is_mandatory":true,"title":"Five-minute average inbound bit rate in bits per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"Primary IPv4 address with prefix length (for example 10.1.1.1/24), empty for unnumbered or Layer 2 interfaces","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lastInput":{"name":"lastInput","type":"\u0007","is_mandatory":true,"title":"Elapsed time since the last packet was received (for example 00:00:00, or never)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lastOutput":{"name":"lastOutput","type":"\u0007","is_mandatory":true,"title":"Elapsed time since the last packet was transmitted (for example 00:00:00, or never)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"linkStatus":{"name":"linkStatus","type":"\u0007","is_mandatory":true,"title":"Interface line status","desc":"Status reported after \"\u003cinterface\u003e is\" in the show interfaces output. Common values are up, down, and administratively down (the last indicating the interface has been shut down).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"macAddress":{"name":"macAddress","type":"\u0007","is_mandatory":true,"title":"Current MAC address in use, which can be overridden from the burned-in address","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"mtu":{"name":"mtu","type":"\u0007","is_mandatory":true,"title":"Maximum transmission unit in bytes","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name, for example GigabitEthernet0/0/0/0, Loopback0, or MgmtEth0/RP0/CPU0/0","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputErrors":{"name":"outputErrors","type":"\u0007","is_mandatory":true,"title":"Total outbound errors since counters were last cleared","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputPackets":{"name":"outputPackets","type":"\u0007","is_mandatory":true,"title":"Total packets transmitted since counters were last cleared","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputPps":{"name":"outputPps","type":"\u0007","is_mandatory":true,"title":"Five-minute average outbound packet rate in packets per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputRate":{"name":"outputRate","type":"\u0007","is_mandatory":true,"title":"Five-minute average outbound bit rate in bits per second","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"overrun":{"name":"overrun","type":"\u0007","is_mandatory":true,"title":"Count of receiver overruns, where the hardware could not hand received data to a buffer","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runts":{"name":"runts","type":"\u0007","is_mandatory":true,"title":"Count of runts, frames smaller than the minimum allowed size","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"speed":{"name":"speed","type":"\u0007","is_mandatory":true,"title":"Negotiated or configured line rate (for example 1000Mb/s)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vlanId":{"name":"vlanId","type":"\u0007","is_mandatory":true,"title":"Dot1Q VLAN ID for a VLAN subinterface, empty on non-VLAN interfaces","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR network interface","desc":"State of a single interface as reported by `show interfaces`, covering identity, operational status, hardware and encapsulation, addressing, and traffic and error counters. The `name` field selects the interface as it appears in the running device, for example `cisco.iosxr.interfaces.where(name == \"GigabitEthernet0/0/0/0\")`. All counter and rate fields are returned as strings exactly as parsed from the command output.","private":true,"defaults":"name linkStatus","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.lineAccountingEntry":{"id":"cisco.iosxr.lineAccountingEntry","name":"cisco.iosxr.lineAccountingEntry","fields":{"methodList":{"name":"methodList","type":"\u0007","is_mandatory":true,"title":"Name of the AAA accounting method list applied, for example default","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Line name the accounting applies to, for example console or default","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Accounting type, for example exec or commands","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR line accounting binding","desc":"Association between a terminal line and an AAA accounting method list, parsed from the running configuration. Useful for verifying that command and EXEC session activity on management lines is accounted.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.lineAuthenticationEntry":{"id":"cisco.iosxr.lineAuthenticationEntry","name":"cisco.iosxr.lineAuthenticationEntry","fields":{"lineType":{"name":"lineType","type":"\u0007","is_mandatory":true,"title":"Line type the binding applies to, for example console, default, or vty","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"method":{"name":"method","type":"\u0007","is_mandatory":true,"title":"Name of the AAA login authentication method list applied to the line, for example default or a named list","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vtyRangeEnd":{"name":"vtyRangeEnd","type":"\u0005","is_mandatory":true,"title":"Last VTY line number when lineType is vty, otherwise unset","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vtyRangeStart":{"name":"vtyRangeStart","type":"\u0005","is_mandatory":true,"title":"First VTY line number when lineType is vty, otherwise unset","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR line login authentication binding","desc":"Association between a terminal line (console, default template, or a VTY range) and the AAA login authentication method list applied to it, parsed from the running configuration. Useful for confirming that management lines require AAA authentication.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.lineAuthorizationEntry":{"id":"cisco.iosxr.lineAuthorizationEntry","name":"cisco.iosxr.lineAuthorizationEntry","fields":{"methodList":{"name":"methodList","type":"\u0007","is_mandatory":true,"title":"Name of the AAA authorization method list applied, for example default","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Line name the authorization applies to, for example console or default","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Authorization type, for example exec or commands","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR line authorization binding","desc":"Association between a terminal line and an AAA authorization method list, parsed from the running configuration. Useful for verifying that command or EXEC authorization is enforced on management lines.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.loggingConfig":{"id":"cisco.iosxr.loggingConfig","name":"cisco.iosxr.loggingConfig","fields":{"bufferLogLevel":{"name":"bufferLogLevel","type":"\u0007","is_mandatory":true,"title":"Buffer logging severity level","desc":"Active severity threshold for messages stored in the in-memory logging buffer, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bufferMessages":{"name":"bufferMessages","type":"\u0005","is_mandatory":true,"title":"Messages logged to the in-memory buffer","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleLogLevel":{"name":"consoleLogLevel","type":"\u0007","is_mandatory":true,"title":"Console logging severity level","desc":"Active severity threshold for messages sent to the console, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging (lowest to highest verbosity).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleMessages":{"name":"consoleMessages","type":"\u0005","is_mandatory":true,"title":"Messages logged to the console","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"dropped":{"name":"dropped","type":"\u0005","is_mandatory":true,"title":"Messages dropped","desc":"Lifetime count of log messages discarded because the logging process could not keep up. A non-zero value indicates lost records.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the syslog logging process is enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"flushes":{"name":"flushes","type":"\u0005","is_mandatory":true,"title":"Buffer flushes","desc":"Lifetime count of times the logging buffer was flushed.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"monitorLogLevel":{"name":"monitorLogLevel","type":"\u0007","is_mandatory":true,"title":"Monitor logging severity level","desc":"Active severity threshold for messages sent to terminal (vty) monitor sessions, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"monitorMessages":{"name":"monitorMessages","type":"\u0005","is_mandatory":true,"title":"Messages logged to terminal monitor sessions","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"overruns":{"name":"overruns","type":"\u0005","is_mandatory":true,"title":"Buffer overruns","desc":"Lifetime count of buffer overruns, where new messages overwrote unread ones. A non-zero value indicates lost records.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapLogLevel":{"name":"trapLogLevel","type":"\u0007","is_mandatory":true,"title":"Trap logging severity level","desc":"Active severity threshold for messages forwarded to remote syslog servers, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapMessages":{"name":"trapMessages","type":"\u0005","is_mandatory":true,"title":"Messages forwarded to remote syslog servers","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR runtime logging counters and per-destination levels","desc":"Operational logging state parsed from the header of `show logging`, covering both the overall syslog process and each output destination. The enabled flag reflects whether the syslog logging process is running; dropped, flushes, and overruns are lifetime counters that signal message loss under load. For each destination (console, monitor, buffer, trap) it reports the active severity level and the number of messages logged so far. Use it to confirm logging is active and not silently dropping records, for example `.where(dropped == 0)`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.ntpEntry":{"id":"cisco.iosxr.ntpEntry","name":"cisco.iosxr.ntpEntry","fields":{"authKeyTypes":{"name":"authKeyTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Authentication key algorithms","desc":"Hash algorithm configured for each authentication key, positionally aligned with authKeys. Commonly md5.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authKeyValues":{"name":"authKeyValues","type":"\u0019\u0007","is_mandatory":true,"title":"Key strings for each authentication key, positionally aligned with authKeys (typically stored encrypted)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authKeys":{"name":"authKeys","type":"\u0019\u0007","is_mandatory":true,"title":"Authentication key IDs defined by ntp authentication-key statements","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authenticate":{"name":"authenticate","type":"\u0004","is_mandatory":true,"title":"Whether \"ntp authenticate\" is configured, requiring servers to authenticate via a trusted key","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"serverKeys":{"name":"serverKeys","type":"\u0019\u0007","is_mandatory":true,"title":"Authentication key ID bound to each server via \"ntp server \u003cip\u003e key \u003cid\u003e\", positionally aligned with servers","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"servers":{"name":"servers","type":"\u0019\u0007","is_mandatory":true,"title":"Configured NTP server addresses from ntp server statements","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceInterface":{"name":"sourceInterface","type":"\u0007","is_mandatory":true,"title":"Interface whose address sources outgoing NTP packets, set by ntp source","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trustedKeys":{"name":"trustedKeys","type":"\u0019\u0007","is_mandatory":true,"title":"Key IDs marked trusted via ntp trusted-key, the keys accepted for authenticating time sources","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR NTP configuration","desc":"Network Time Protocol settings parsed from `show running-config ntp`, including authentication state, defined authentication keys, configured time servers, the source interface, and the set of trusted keys. Useful for auditing whether NTP authentication is enforced and time sources are restricted to trusted, authenticated servers.","private":true,"defaults":"servers","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.passwordPolicy":{"id":"cisco.iosxr.passwordPolicy","name":"cisco.iosxr.passwordPolicy","fields":{"lifetimeUnit":{"name":"lifetimeUnit","type":"\u0007","is_mandatory":true,"title":"Unit for the password lifetime value, one of years, months, days, hours, minutes, or seconds","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lifetimeValue":{"name":"lifetimeValue","type":"\u0007","is_mandatory":true,"title":"Password lifetime, expressed in lifetimeUnit units, after which the password must be changed","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"minCharChange":{"name":"minCharChange","type":"\u0007","is_mandatory":true,"title":"Minimum number of characters that a new password must change relative to the previous password","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"minLength":{"name":"minLength","type":"\u0007","is_mandatory":true,"title":"Minimum password length","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"numeric":{"name":"numeric","type":"\u0007","is_mandatory":true,"title":"Minimum number of numeric characters a password must contain","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"specialChar":{"name":"specialChar","type":"\u0007","is_mandatory":true,"title":"Minimum number of special characters a password must contain","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR password policy","desc":"A named AAA password policy parsed from `show running-config aaa password-policy`, defining password lifetime, minimum length, minimum required character change, and minimum counts of numeric and special characters. Useful for verifying password-strength requirements. The name field selects the policy.","private":true,"defaults":"name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runConsoleExecTimeoutEntry":{"id":"cisco.iosxr.runConsoleExecTimeoutEntry","name":"cisco.iosxr.runConsoleExecTimeoutEntry","fields":{"minutes":{"name":"minutes","type":"\u0005","is_mandatory":true,"title":"Exec-timeout minutes component","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"seconds":{"name":"seconds","type":"\u0005","is_mandatory":true,"title":"Exec-timeout seconds component","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR console exec-timeout configuration","desc":"Idle exec-timeout configured on the console line, parsed from the running config. A value of 0 minutes and 0 seconds disables the timeout so a console session never logs out, a common hardening finding. Use it to require a non-zero timeout, for example `.where(minutes == 0 \u0026\u0026 seconds == 0)` to flag disabled timeouts.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runKeyChainEntry":{"id":"cisco.iosxr.runKeyChainEntry","name":"cisco.iosxr.runKeyChainEntry","fields":{"key":{"name":"key","type":"\u0005","is_mandatory":true,"title":"Key index (identifier) within the chain","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyString":{"name":"keyString","type":"\u0007","is_mandatory":true,"title":"Key string (shared secret) for this key","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Key chain name","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Key chain key entry from running config","desc":"One key within a key chain, identified by chain name and key index, with its key string used to authenticate routing protocols.","private":true,"defaults":"name key","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runLineAcl":{"id":"cisco.iosxr.runLineAcl","name":"cisco.iosxr.runLineAcl","fields":{"acl":{"name":"acl","type":"\u0019\u001bcisco.iosxr.runLineAclEntry","title":"Access-classes applied to the line, one per direction","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineTemplate":{"name":"lineTemplate","type":"\u0007","is_mandatory":true,"title":"Line template name, e.g. `default` or `ssh-only-config`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"init":{"args":[{"name":"lineTemplate","type":"\u0007"}]},"title":"Line access-class configuration from running config","desc":"Access-lists bound to a line template that restrict which sources may open a session on it. Select the line with the `lineTemplate` argument (for example `default`), then read `acl` for the applied access-classes. Command: `show running-config formal | include line \u003clineTemplate\u003e access-class`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runLineAclEntry":{"id":"cisco.iosxr.runLineAclEntry","name":"cisco.iosxr.runLineAclEntry","fields":{"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"Name of the access-list applied to the line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Traffic direction the access-list filters, either ingress or egress","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineTemplate":{"name":"lineTemplate","type":"\u0007","is_mandatory":true,"title":"Line template name, e.g. `default` or `ssh-only-config`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Line access-class entry from running config","desc":"One access-class bound to a line template, giving the traffic direction it filters and the access-list name.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runLineTransportIO":{"id":"cisco.iosxr.runLineTransportIO","name":"cisco.iosxr.runLineTransportIO","fields":{"entries":{"name":"entries","type":"\u0019\u001bcisco.iosxr.runLineTransportIOEntry","title":"Transport configurations for the line, one per direction","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineTemplate":{"name":"lineTemplate","type":"\u0007","is_mandatory":true,"title":"Line template name, e.g. `default` or `ssh-only-config`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"init":{"args":[{"name":"lineTemplate","type":"\u0007"}]},"title":"Line transport-input/output configuration from running config","desc":"Transport protocols allowed inbound and outbound on a line template. Select the line with the `lineTemplate` argument (for example `default` or `ssh-only-config`), then read `entries` for the per-direction protocols. Command: `show running-config formal | include line \u003clineTemplate\u003e transport`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runLineTransportIOEntry":{"id":"cisco.iosxr.runLineTransportIOEntry","name":"cisco.iosxr.runLineTransportIOEntry","fields":{"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Transport direction, either `input` (inbound) or `output` (outbound)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineTemplate":{"name":"lineTemplate","type":"\u0007","is_mandatory":true,"title":"Line template name, e.g. `default` or `ssh-only-config`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocols":{"name":"protocols","type":"\u0007","is_mandatory":true,"title":"Protocols enabled for this direction, for example `ssh`, `telnet`, or `none`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Line transport-input/output entry from running config","desc":"One transport direction on a line template and the protocols permitted on it, for example inbound `ssh` only.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runLoggingConfig":{"id":"cisco.iosxr.runLoggingConfig","name":"cisco.iosxr.runLoggingConfig","fields":{"bufferLogFileSize":{"name":"bufferLogFileSize","type":"\u0005","is_mandatory":true,"title":"Configured in-memory logging buffer size in bytes, when set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bufferLogLevel":{"name":"bufferLogLevel","type":"\u0007","is_mandatory":true,"title":"Configured buffered logging severity level","desc":"Severity keyword set by `logging buffered`, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging. Empty when buffered logging is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleLogFileSize":{"name":"consoleLogFileSize","type":"\u0005","is_mandatory":true,"title":"Configured console log buffer size in bytes, when set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleLogLevel":{"name":"consoleLogLevel","type":"\u0007","is_mandatory":true,"title":"Configured console logging severity level","desc":"Severity keyword set by `logging console`, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging. Empty when console logging is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"monitorLogFileSize":{"name":"monitorLogFileSize","type":"\u0005","is_mandatory":true,"title":"Configured monitor log buffer size in bytes, when set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"monitorLogLevel":{"name":"monitorLogLevel","type":"\u0007","is_mandatory":true,"title":"Configured monitor logging severity level","desc":"Severity keyword set by `logging monitor` for terminal (vty) sessions, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceInterface":{"name":"sourceInterface","type":"\u0007","is_mandatory":true,"title":"Source interface for outbound syslog messages","desc":"Interface set by `logging source-interface` whose IP address is used as the source for syslog packets. Empty when unset, in which case the router chooses the outgoing interface address.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapLogFileSize":{"name":"trapLogFileSize","type":"\u0005","is_mandatory":true,"title":"Configured trap log buffer size in bytes, when set","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapLogLevel":{"name":"trapLogLevel","type":"\u0007","is_mandatory":true,"title":"Configured trap logging severity level","desc":"Severity keyword set by `logging trap` for remote syslog servers, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR configured logging destinations and source interface","desc":"Logging configuration parsed from `show running-config logging`, giving the intended (not runtime) settings for each destination. For console, monitor, buffer, and trap it reports the configured severity level and, where set, the buffer or file size in bytes. The sourceInterface field names the interface whose address is used as the source of outbound syslog messages. Use it to audit that log levels and a stable logging source are configured, for example `.where(bufferLogLevel != \"\")`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runLoggingSyslogHost":{"id":"cisco.iosxr.runLoggingSyslogHost","name":"cisco.iosxr.runLoggingSyslogHost","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Syslog receiver IP address or hostname","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"port":{"name":"port","type":"\u0007","is_mandatory":true,"title":"Syslog destination port","desc":"UDP port for syslog delivery; the default is 514 when not explicitly configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Per-host logging severity level","desc":"Severity keyword applied to this host when set, one of emergencies, alerts, critical, errors, warnings, notifications, informational, or debugging. Empty when the host uses the global trap level.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF used to reach the syslog host","desc":"Name of the VRF the logging traffic is sent through, when the host is bound to one. Empty for the default VRF.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR syslog remote host configuration","desc":"Remote syslog destinations parsed from `show running-config logging`. Each entry names a receiver and, where set, the destination port, per-host severity level, and VRF used to reach it. Use it to confirm logs are forwarded to a central collector, for example `cisco.iosxr.runLoggingSyslogHosts.length \u003e 0`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runManagementPlaneRule":{"id":"cisco.iosxr.runManagementPlaneRule","name":"cisco.iosxr.runManagementPlaneRule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Rule action, one of allow, deny, or none","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"address":{"name":"address","type":"\u000f","is_mandatory":true,"title":"Peer address or subnet the rule matches, from the `peer address` clause","desc":"`any` is represented as 0.0.0.0/0. Empty when the rule has no peer restriction.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Path the rule applies to, either inband (data-plane interfaces) or out-of-band (dedicated management interfaces)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.interface","is_mandatory":true,"title":"Interface the rule applies to","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipVersion":{"name":"ipVersion","type":"\u0007","is_mandatory":true,"title":"IP version of the peer address clause, either ipv4 or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Management protocol governed by the rule, for example ssh, telnet, snmp, tftp, http, netconf, or all","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR management-plane protection rule","desc":"A single allow, deny, or none rule from `control-plane management-plane`, which restricts the protocols and peers that may reach the router's management plane over inband (data) or out-of-band (dedicated management) interfaces. Parsed from `show running-config formal control-plane`. Use it to verify management access is locked down to expected protocols and peer addresses.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterBgpEntry":{"id":"cisco.iosxr.runRouterBgpEntry","name":"cisco.iosxr.runRouterBgpEntry","fields":{"asNumber":{"name":"asNumber","type":"\u0005","is_mandatory":true,"title":"Autonomous System (AS) number the BGP process runs under, from `router bgp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"neighbors":{"name":"neighbors","type":"\u0019\u001bcisco.iosxr.runRouterBgpNeighbor","is_mandatory":true,"title":"Configured BGP neighbors (peers) for this AS","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"BGP routing process in a Cisco IOS XR running config","desc":"A `router bgp` instance in the running config, identified by its Autonomous System (AS) number, together with its configured neighbors. Parsed from `show running-config router bgp`. Selected by AS number; use it to audit BGP peering, including session passwords and shutdown state.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterBgpNeighbor":{"id":"cisco.iosxr.runRouterBgpNeighbor","name":"cisco.iosxr.runRouterBgpNeighbor","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form description text configured for the neighbor. Empty when none.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ebgpMultihop":{"name":"ebgpMultihop","type":"\u0005","is_mandatory":true,"title":"Maximum hop count allowed to reach a multihop eBGP neighbor, from `ebgp-multihop`. Null when not configured (directly connected).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipAddress":{"name":"ipAddress","type":"\u000f","is_mandatory":true,"title":"IP address of the BGP neighbor (peer)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"password":{"name":"password","type":"\u0007","is_mandatory":true,"title":"MD5 session password as stored in the running config. Empty when no neighbor password is set.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordType":{"name":"passwordType","type":"\u0007","is_mandatory":true,"title":"Storage form of the neighbor password, either clear or encrypted","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"remoteAs":{"name":"remoteAs","type":"\u0005","is_mandatory":true,"title":"Remote AS number of the neighbor, from `remote-as`. iBGP when equal to the local AS, eBGP when different.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"shutdown":{"name":"shutdown","type":"\u0004","is_mandatory":true,"title":"Whether the neighbor is administratively shut down (`shutdown`), which disables the session","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"updateSource":{"name":"updateSource","type":"\u0007","is_mandatory":true,"title":"Interface whose address sources the BGP TCP session, from `update-source`. Empty when the outgoing interface address is used.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"BGP neighbor in a Cisco IOS XR running config","desc":"A single BGP peer configured under a `router bgp` instance, exposing its remote AS, session password, description, update source, multihop setting, and administrative shutdown state. Use it to verify that eBGP sessions are authenticated and that stale neighbors are shut down.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterEigrpAddressFamily":{"id":"cisco.iosxr.runRouterEigrpAddressFamily","name":"cisco.iosxr.runRouterEigrpAddressFamily","fields":{"interfaces":{"name":"interfaces","type":"\u0019\u001bcisco.iosxr.runRouterEigrpAddressFamilyInterface","is_mandatory":true,"title":"Interfaces enrolled in this EIGRP address family, each with its authentication key chain","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Address family of the EIGRP configuration, either ipv4 or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"EIGRP address family within a Cisco IOS XR EIGRP process","desc":"An IPv4 or IPv6 address family configured under a `router eigrp` instance in the running config, along with the interfaces enrolled in it and their EIGRP packet authentication. Parsed from `show running-config router eigrp`. Use it to confirm that EIGRP adjacencies authenticate their protocol packets with a key chain.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterEigrpAddressFamilyInterface":{"id":"cisco.iosxr.runRouterEigrpAddressFamilyInterface","name":"cisco.iosxr.runRouterEigrpAddressFamilyInterface","fields":{"authKeyChain":{"name":"authKeyChain","type":"\u0007","is_mandatory":true,"title":"Name of the key chain authenticating EIGRP packets on this interface, from `authentication keychain`. Empty when no authentication is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.interface","is_mandatory":true,"title":"Interface running EIGRP in this address family","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Interface enrolled in a Cisco IOS XR EIGRP address family","desc":"A single interface configured under an EIGRP address family in the running config, exposing whether EIGRP packets on that interface are authenticated with a key chain (`authentication keychain \u003cname\u003e`).","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterEigrpEntry":{"id":"cisco.iosxr.runRouterEigrpEntry","name":"cisco.iosxr.runRouterEigrpEntry","fields":{"addressFamilies":{"name":"addressFamilies","type":"\u0019\u001bcisco.iosxr.runRouterEigrpAddressFamily","is_mandatory":true,"title":"Address families configured under the EIGRP process","desc":"Per-family (IPv4/IPv6) configuration, each carrying the participating interfaces and their authentication key chains.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"asNumber":{"name":"asNumber","type":"\u0005","is_mandatory":true,"title":"Autonomous system number of the EIGRP process","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR EIGRP routing process","desc":"EIGRP router instances parsed from `show running-config router eigrp`. Each instance is identified by its autonomous system number and exposes the configured address families. Selection is by the AS number, and the addressFamilies field carries the per-family configuration including interfaces and their authentication key chains.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterHsrpEntry":{"id":"cisco.iosxr.runRouterHsrpEntry","name":"cisco.iosxr.runRouterHsrpEntry","fields":{"addressFamily":{"name":"addressFamily","type":"\u0007","is_mandatory":true,"title":"Address family of the HSRP group, either ipv4 or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authentication":{"name":"authentication","type":"\u0007","is_mandatory":true,"title":"HSRP authentication string configured for the group, from `authentication`. Empty when no authentication is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"groupNumber":{"name":"groupNumber","type":"\u0005","is_mandatory":true,"title":"HSRP group number","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.interface","is_mandatory":true,"title":"Interface the HSRP group is configured on","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"HSRP group on a Cisco IOS XR interface","desc":"A Hot Standby Router Protocol group configured under an interface's address family in the running config, exposing its group number and authentication string. Parsed from `show running-config router hsrp`. Use it to confirm first-hop redundancy groups are authenticated.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterIsisEntry":{"id":"cisco.iosxr.runRouterIsisEntry","name":"cisco.iosxr.runRouterIsisEntry","fields":{"interfaces":{"name":"interfaces","type":"\u0019\u001bcisco.iosxr.runRouterIsisInterface","is_mandatory":true,"title":"Interfaces enabled for this IS-IS process, each with its hello authentication key chain","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lspPasswordKeyChain":{"name":"lspPasswordKeyChain","type":"\u0007","is_mandatory":true,"title":"Key chain authenticating link-state PDUs (LSPs), from `lsp-password keychain`. Empty when LSP authentication is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Process name (tag) of the IS-IS instance, from `router isis`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"IS-IS routing process in a Cisco IOS XR running config","desc":"A `router isis` instance in the running config, identified by its process name (tag), with its link-state PDU authentication key chain and the interfaces enabled for the process. Parsed from `show running-config router isis`. Use it to confirm that IS-IS LSPs and hellos are authenticated with key chains.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterIsisInterface":{"id":"cisco.iosxr.runRouterIsisInterface","name":"cisco.iosxr.runRouterIsisInterface","fields":{"helloAuthKeyChain":{"name":"helloAuthKeyChain","type":"\u0007","is_mandatory":true,"title":"Key chain authenticating IS-IS hello PDUs on this interface, from `hello-password keychain`. Empty when hello authentication is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.interface","is_mandatory":true,"title":"Interface running IS-IS","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Interface enabled for a Cisco IOS XR IS-IS process","desc":"A single interface configured under an IS-IS instance, exposing the key chain that authenticates IS-IS hello PDUs on that interface (`hello-password keychain \u003cname\u003e`).","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterOspfArea":{"id":"cisco.iosxr.runRouterOspfArea","name":"cisco.iosxr.runRouterOspfArea","fields":{"addressFamily":{"name":"addressFamily","type":"\u0007","is_mandatory":true,"title":"Address family of the OSPF configuration, either ipv4 or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"areaId":{"name":"areaId","type":"\u0005","is_mandatory":true,"title":"Area ID as configured, an integer where 0 is the backbone area","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authKeyChain":{"name":"authKeyChain","type":"\u0007","is_mandatory":true,"title":"Name of the key chain used for area authentication, from `authentication keychain`. Empty when key-chain authentication is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"msgDigestAlgorithm":{"name":"msgDigestAlgorithm","type":"\u0007","is_mandatory":true,"title":"Hash algorithm of the message-digest key, for example md5. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"msgDigestKey":{"name":"msgDigestKey","type":"\u0007","is_mandatory":true,"title":"Message-digest key value as stored in the running config (typically encrypted). Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"msgDigestKeyId":{"name":"msgDigestKeyId","type":"\u0005","is_mandatory":true,"title":"Key ID of the message-digest (MD5) authentication key, from `message-digest-key`. Null when message-digest authentication is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"processId":{"name":"processId","type":"\u0005","is_mandatory":true,"title":"OSPF process ID that owns this area","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"OSPF area within a Cisco IOS XR OSPF process","desc":"A single OSPF area configured under a `router ospf` process in the running config, with its address family and its authentication (a key chain and/or a message-digest MD5 key). Parsed from `show running-config router ospf`. Use it to confirm that OSPF areas authenticate adjacencies rather than running with authentication off.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterRipInterface":{"id":"cisco.iosxr.runRouterRipInterface","name":"cisco.iosxr.runRouterRipInterface","fields":{"authKeyChain":{"name":"authKeyChain","type":"\u0007","is_mandatory":true,"title":"Key chain used for RIP authentication on this interface, from `authentication keychain`. Empty when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authMode":{"name":"authMode","type":"\u0007","is_mandatory":true,"title":"RIP authentication mode, either md5 or text. Empty when authentication is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.interface","is_mandatory":true,"title":"Interface running RIP","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Interface running RIP in a Cisco IOS XR running config","desc":"A single interface configured under `router rip`, exposing the key chain and mode used to authenticate RIP updates on that interface. Parsed from `show running-config router rip`. Use it to confirm RIP interfaces authenticate updates with MD5 rather than plain text.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runRouterVrrpEntry":{"id":"cisco.iosxr.runRouterVrrpEntry","name":"cisco.iosxr.runRouterVrrpEntry","fields":{"addressFamily":{"name":"addressFamily","type":"\u0007","is_mandatory":true,"title":"Address family of the VRRP group, either ipv4 or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"groupNumber":{"name":"groupNumber","type":"\u0005","is_mandatory":true,"title":"VRRP group (virtual router) number","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.interface","is_mandatory":true,"title":"Interface the VRRP group is configured on","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"textAuth":{"name":"textAuth","type":"\u0007","is_mandatory":true,"title":"Plain-text authentication string, from `text-authentication`","desc":"Empty when not configured. Plain-text VRRP authentication is weak because the string travels in the clear.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"VRRP group on a Cisco IOS XR interface","desc":"A Virtual Router Redundancy Protocol group configured under an interface's address family in the running config, exposing its group number and any plain-text authentication string. Parsed from `show running-config router vrrp`. Use it to flag VRRP groups relying on weak plain-text authentication.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runSnmpCommunitiesEntry":{"id":"cisco.iosxr.runSnmpCommunitiesEntry","name":"cisco.iosxr.runSnmpCommunitiesEntry","fields":{"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"Access-list restricting SNMP managers","desc":"Named or numbered access-list bound to the community, limiting which source addresses may use it, e.g. \"my-acl\" or \"10\". Empty when no access-list is applied, meaning any manager may use the community.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"addressFamily":{"name":"addressFamily","type":"\u0007","is_mandatory":true,"title":"Address family the community applies to","desc":"Either \"IPv4\" or \"IPv6\" when scoped by `snmp-server community \u003cname\u003e \u003cRO|RW\u003e {IPv4|IPv6}`. Empty when the community applies to both families.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"community":{"name":"community","type":"\u0007","is_mandatory":true,"title":"Community string, e.g. \"public\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"privilege":{"name":"privilege","type":"\u0007","is_mandatory":true,"title":"Access privilege","desc":"Either \"RO\" (read-only) or \"RW\" (read-write). RW communities allow configuration changes over SNMP and warrant close review.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR SNMPv1/v2c community string configuration","desc":"SNMP community strings parsed from `snmp-server community` lines in the running config, the shared-secret access control for SNMPv1 and SNMPv2c. Each entry pairs a community name with its access privilege, address family, and optional access-list restricting which managers may use it. Use it to flag weak or overly permissive community strings, for example `.where(community == \"public\" || privilege == \"RW\")`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runSnmpGroupsEntry":{"id":"cisco.iosxr.runSnmpGroupsEntry","name":"cisco.iosxr.runSnmpGroupsEntry","fields":{"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"Access-list restricting the group","desc":"Named or numbered access-list limiting the source addresses that may use the group, e.g. \"my-acl\" or \"10\". Empty when no access-list is applied.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipVersion":{"name":"ipVersion","type":"\u0007","is_mandatory":true,"title":"Address family for the group's access-list","desc":"Either \"IPv4\" or \"IPv6\" when the group is scoped to one family.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SNMP group name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3PrivacyLevel":{"name":"v3PrivacyLevel","type":"\u0007","is_mandatory":true,"title":"SNMPv3 security level for the group","desc":"Security-level keyword configured for a v3 group, one of \"noauth\" (no authentication, no privacy), \"auth\" (authentication, no privacy), or \"priv\" (authentication and privacy). Empty for v1/v2c groups.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"SNMP version for the group","desc":"One of \"1\", \"2c\", or \"3\".","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR SNMP access group configuration","desc":"SNMP groups parsed from `snmp-server group` lines in the running config, mapping a group to its SNMP version, security level, and access-list. Views and permissions bound to the group govern what its members may read or write. Use it to review v3 groups that lack authentication and privacy, for example `.where(version == \"3\" \u0026\u0026 v3PrivacyLevel != \"priv\")`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runSnmpHostsEntry":{"id":"cisco.iosxr.runSnmpHostsEntry","name":"cisco.iosxr.runSnmpHostsEntry","fields":{"community":{"name":"community","type":"\u0007","is_mandatory":true,"title":"Community string for SNMPv1/v2c notifications","desc":"Shared secret sent with v1/v2c traps and informs. Empty for SNMPv3 hosts.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"Notification receiver IP address or hostname","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"notificationType":{"name":"notificationType","type":"\u0007","is_mandatory":true,"title":"Notification type","desc":"Either \"traps\" (unacknowledged) or \"informs\" (acknowledged) SNMP notifications.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3SecurityLevel":{"name":"v3SecurityLevel","type":"\u0007","is_mandatory":true,"title":"SNMPv3 security level","desc":"One of \"noauth\" (no authentication, no privacy), \"auth\" (authentication, no privacy), or \"priv\" (authentication and privacy). Empty for v1/v2c hosts.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3User":{"name":"v3User","type":"\u0007","is_mandatory":true,"title":"SNMPv3 user sending notifications","desc":"Username under whose credentials v3 notifications are sent. Empty for v1/v2c hosts.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"SNMP version used to send notifications","desc":"One of \"1\", \"2c\", or \"3\".","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR SNMP notification host configuration","desc":"SNMP trap and inform destinations parsed from `snmp-server host` lines in the running config. Each entry names a receiver and the protocol version, community or user, and security level used to send notifications to it. Use it to confirm notifications go only to intended collectors and, for SNMPv3, use an authenticated and encrypted security level, for example `.where(version == \"3\" \u0026\u0026 v3SecurityLevel == \"priv\")`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runSnmpUsersEntry":{"id":"cisco.iosxr.runSnmpUsersEntry","name":"cisco.iosxr.runSnmpUsersEntry","fields":{"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"Access-list restricting the user","desc":"Named or numbered access-list limiting the source addresses that may use the user, e.g. \"my-acl\" or \"10\". Empty when no access-list is applied.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"Group the user belongs to","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Address family for the user's access-list","desc":"Either \"IPv4\" or \"IPv6\" when the user is scoped to one family.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"SNMPv3 username","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3AuthKey":{"name":"v3AuthKey","type":"\u0007","is_mandatory":true,"title":"SNMPv3 authentication key","desc":"Stored authentication key, typically encrypted in the running config. Empty when the user has no authentication.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3AuthProtocol":{"name":"v3AuthProtocol","type":"\u0007","is_mandatory":true,"title":"SNMPv3 authentication protocol","desc":"One of \"md5\" or \"sha\". SHA is preferred; MD5 is deprecated as cryptographically weak. Empty when the user has no authentication.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3PrivKey":{"name":"v3PrivKey","type":"\u0007","is_mandatory":true,"title":"SNMPv3 privacy key","desc":"Stored privacy (encryption) key, typically encrypted in the running config. Empty when the user has no privacy.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3PrivKeyLength":{"name":"v3PrivKeyLength","type":"\u0005","is_mandatory":true,"title":"SNMPv3 privacy key length in bits, when set","desc":"AES key length such as 128, 192, or 256. Null when not specified.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"v3PrivProtocol":{"name":"v3PrivProtocol","type":"\u0007","is_mandatory":true,"title":"SNMPv3 privacy protocol","desc":"Encryption algorithm for privacy, one of \"des\", \"3des\", or \"aes\". AES is preferred; DES is weak. Empty when the user has no privacy.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"SNMP version for the user","desc":"Typically \"3\"; v1/v2c users are community-based and mapped through groups instead.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR SNMPv3 user configuration","desc":"SNMPv3 users parsed from `snmp-server user` lines in the running config, including group membership and the authentication and privacy protocols and keys. Use it to verify every v3 user has strong authentication and privacy configured and is not stored with weak algorithms, for example `.where(v3AuthProtocol == \"sha\" \u0026\u0026 v3PrivProtocol == \"aes\")`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.runSshVrfAccessListEntry":{"id":"cisco.iosxr.runSshVrfAccessListEntry","name":"cisco.iosxr.runSshVrfAccessListEntry","fields":{"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"Name of the access-list applied","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol the access-list filters, either IPv4 or IPv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"side":{"name":"side","type":"\u0007","is_mandatory":true,"title":"SSH side the access-list applies to, either server or client","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF name the access-list applies within, for example `default`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"SSH VRF access-list entry from running config","desc":"One access-list restricting SSH for a given side, VRF, and protocol.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.smallServer":{"id":"cisco.iosxr.smallServer","name":"cisco.iosxr.smallServer","fields":{"ipVersion":{"name":"ipVersion","type":"\u0007","is_mandatory":true,"title":"IP version the small servers listen on, ipv4 or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"maxServers":{"name":"maxServers","type":"\u0005","is_mandatory":true,"title":"Maximum number of concurrent small-server connections allowed","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Transport protocol the small servers run over, tcp or udp","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR small servers configuration","desc":"State of the minor TCP and UDP small servers (echo, discard, chargen, daytime) enabled by service tcp-small-servers or service udp-small-servers. Presence of these servers is a hardening concern. The protocol field selects the entry.","private":true,"defaults":"protocol","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.snmpUsersEntry":{"id":"cisco.iosxr.snmpUsersEntry","name":"cisco.iosxr.snmpUsersEntry","fields":{"engineId":{"name":"engineId","type":"\u0007","is_mandatory":true,"title":"SNMP engine ID the user is bound to","desc":"Unique identifier of the SNMP engine, used with the user's keys for v3 authentication and privacy.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"storageType":{"name":"storageType","type":"\u0007","is_mandatory":true,"title":"Storage type for the user entry","desc":"How the user definition is persisted, typically \"nonvolatile\" (survives reload) or \"volatile\" (lost on reload).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"SNMPv3 username","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR SNMP users from show snmp user","desc":"SNMPv3 users as reported operationally by `show snmp user`, giving the runtime view (username, storage type, and SNMP engine ID) rather than the configured credentials. Complements cisco.iosxr.runSnmpUsersEntry, which parses the running config.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.sshConfig":{"id":"cisco.iosxr.sshConfig","name":"cisco.iosxr.sshConfig","fields":{"netconfVrfs":{"name":"netconfVrfs","type":"\u0019\u0007","is_mandatory":true,"title":"VRFs the NETCONF-over-SSH server listens on","desc":"VRF names from `ssh server netconf vrf \u003cname\u003e` lines, enabling the NETCONF subsystem over SSH on those VRFs.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"SSH authentication negotiation timeout in seconds","desc":"Time from `ssh timeout` allowed for a client to authenticate to AAA before the connection is dropped (default 30 seconds, range 5 to 120). Null when unset.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Enforced SSH protocol version","desc":"Value from `ssh server v\u003cn\u003e`, for example v2 (SSHv2) or v1 (SSHv1). Empty when no version is pinned, in which case the server accepts both. SSHv1 is insecure and should not be permitted.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrfs":{"name":"vrfs","type":"\u0019\u0007","is_mandatory":true,"title":"VRFs the SSH server listens on","desc":"VRF names from `ssh server vrf \u003cname\u003e` lines. The SSH server accepts connections only on VRFs listed here.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR SSH server configuration","desc":"SSH server settings, parsed from `show running-config ssh`. Covers the enforced protocol version, the authentication negotiation timeout, and the VRFs the SSH and NETCONF-over-SSH servers listen on. Confirming the server is pinned to SSHv2 is a baseline hardening check.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.type6serverConfig":{"id":"cisco.iosxr.type6serverConfig","name":"cisco.iosxr.type6serverConfig","fields":{"aesConfigState":{"name":"aesConfigState","type":"\u0007","is_mandatory":true,"title":"AES encryption configuration state, Enabled or Disabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"masterKeyInprogress":{"name":"masterKeyInprogress","type":"\u0007","is_mandatory":true,"title":"Whether a master key operation (creation or update) is currently in progress, Yes or No","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"masterkeyConfigState":{"name":"masterkeyConfigState","type":"\u0007","is_mandatory":true,"title":"Master key configuration state, Enabled or Disabled (a master key is required for Type 6 encryption)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type6FeatureState":{"name":"type6FeatureState","type":"\u0007","is_mandatory":true,"title":"Overall Type 6 feature state, Enabled or Disabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR Type 6 password encryption state","desc":"Status of the AES-based Type 6 password encryption feature as reported by `show type6 server`, including whether AES encryption and the master key are configured, whether a master key operation is in progress, and the overall feature state. Useful for confirming that reversible stored secrets are protected by Type 6 encryption.","private":true,"defaults":"aesConfigState","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.user":{"id":"cisco.iosxr.user","name":"cisco.iosxr.user","fields":{"groups":{"name":"groups","type":"\u0019\u0007","is_mandatory":true,"title":"User group memberships that grant task-based privileges, for example root-system, netadmin, or cisco-support","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordPolicy":{"name":"passwordPolicy","type":"\u0007","is_mandatory":true,"title":"Name of the aaa password-policy applied to this account, empty when none is applied","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordType":{"name":"passwordType","type":"\u0007","is_mandatory":true,"title":"Password encoding type","desc":"Encoding of the password field: 0 (cleartext) or 7 (Vigenere cipher). Type 7 is trivially reversible and should not be used.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordValue":{"name":"passwordValue","type":"\u0007","is_mandatory":true,"title":"Stored password value","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"secretType":{"name":"secretType","type":"\u0007","is_mandatory":true,"title":"Secret hash type","desc":"Encoding of the enable-style secret: 5 (MD5), 8 (SHA256), 9 (scrypt), or 10 (SHA512). Types 8, 9, and 10 use strong hashing; type 5 (MD5) is considered weak.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"secretValue":{"name":"secretValue","type":"\u0007","is_mandatory":true,"title":"Stored secret hash value","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Account name","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR local user account","desc":"A locally defined user account parsed from `show running-config username`, including group membership and the stored secret and password material with their encoding types. Useful for auditing account privilege (via groups) and detecting weak password storage. Select by username, for example `cisco.iosxr.users.where(username == \"admin\")`.","private":true,"defaults":"username groups","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.iosxr.vtyLinesEntry":{"id":"cisco.iosxr.vtyLinesEntry","name":"cisco.iosxr.vtyLinesEntry","fields":{"poolName":{"name":"poolName","type":"\u0007","is_mandatory":true,"title":"Name of the VTY pool","desc":"Well-known pools include `default` (Telnet/SSH sessions), `eem` (Embedded Event Manager), and `default-ssh` on some releases; custom pools carry administrator-chosen names.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"rangeEnd":{"name":"rangeEnd","type":"\u0005","is_mandatory":true,"title":"Last VTY line number in the pool's range","desc":"Highest line index reserved by the pool (for example 99). The pool spans rangeStart through rangeEnd inclusive.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"rangeStart":{"name":"rangeStart","type":"\u0005","is_mandatory":true,"title":"First VTY line number in the pool's range","desc":"Lowest line index reserved by the pool (for example 0).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"templateName":{"name":"templateName","type":"\u0007","is_mandatory":true,"title":"Line template bound to the pool","desc":"Name of the `line template` (or `default`) applied to every line in the pool, supplying its timeout, transport, ACL, and authentication configuration.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco IOS XR VTY pool definition","desc":"A single `vty-pool` entry, parsed from `show running-config formal | include vty-pool`. A VTY pool reserves a contiguous range of virtual terminal lines and binds them to a line template, which carries the exec-timeout, transport, access-class, and authentication settings for remote sessions in that pool.","private":true,"defaults":"poolName templateName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos":{"id":"cisco.nxos","name":"cisco.nxos","fields":{"accessControlList":{"name":"accessControlList","type":"\u001bcisco.nxos.accessControlList","title":"Cisco NX-OS access control list (ACL)","desc":"A single ACL from `show access-lists`, keyed by name and type, with its ordered entries. Lets audits inspect filtering rules applied to interfaces, VTY lines, and other features. Select one with the name field, for example `cisco.nxos.accessControlList.where(name == \"MGMT-IN\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"acl":{"name":"acl","type":"\u0019\u001bcisco.nxos.accessControlList","title":"Access Control Lists (ACLs) and their entries.","desc":"Obtained by running `show access-lists`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bgp":{"name":"bgp","type":"\u0019\u001bcisco.nxos.bgpRouterConfig","title":"BGP routing processes, neighbors, and address families.","desc":"Obtained by running `show running-config bgp`. Empty when the bgp feature is not enabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bgpRouterConfig":{"name":"bgpRouterConfig","type":"\u001bcisco.nxos.bgpRouterConfig","title":"Cisco NX-OS BGP router configuration","desc":"A single `router bgp` process from `show running-config bgp`, keyed by autonomous system number. Exposes the router ID, neighbor-change logging, and the configured neighbors with their authentication and address families. Central to auditing BGP session authentication and peering.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"boot":{"name":"boot","type":"\u001bcisco.nxos.bootConfig","title":"Boot image and Power-On Auto Provisioning (POAP) settings.","desc":"Obtained by running `show running-config | include boot`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bootConfig":{"name":"bootConfig","type":"\u001bcisco.nxos.bootConfig","title":"Cisco NX-OS boot configuration","desc":"Boot behavior parsed from the running-config `boot` lines: the boot device order, whether Power-On Auto Provisioning (POAP) is armed, and the NX-OS software image loaded from bootflash. Useful for confirming a device boots its intended image and does not fall back to an unattended network install.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"cdpAll":{"name":"cdpAll","type":"\u0019\u001bcisco.nxos.cdpAllEntry","title":"Cisco Discovery Protocol (CDP) status per interface and globally.","desc":"Obtained by running `show cdp all`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cdpAllEntry":{"name":"cdpAllEntry","type":"\u001bcisco.nxos.cdpAllEntry","title":"Cisco NX-OS CDP status for an interface","desc":"Per-interface Cisco Discovery Protocol state from `show cdp all`: whether CDP is enabled on the interface and globally, the interface operational status, and the advertisement refresh and hold timers. Lets audits flag interfaces where CDP (which leaks device and topology details to neighbors) is still on.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"clock":{"name":"clock","type":"\u001bcisco.nxos.clockConfiguration","title":"Clock and time-zone configuration.","desc":"Obtained by running `show running-config all | include clock`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"clockConfiguration":{"name":"clockConfiguration","type":"\u001bcisco.nxos.clockConfiguration","title":"Cisco NX-OS clock and timezone configuration","desc":"Timezone and daylight-saving settings parsed from `show running-config all | include clock`. Covers the timezone name, its offset from UTC in hours and minutes, and whether summer-time (DST) is configured. When no clock config is present the device is on UTC with a zero offset and DST off, which is what these fields default to.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"copp":{"name":"copp","type":"\u001bcisco.nxos.coppConfig","title":"Control Plane Policing (CoPP) profile applied to the control plane.","desc":"Obtained by running `show running-config | include copp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"coppConfig":{"name":"coppConfig","type":"\u001bcisco.nxos.coppConfig","title":"Control Plane Policing (CoPP) profile applied on the device","desc":"The active CoPP built-in best-practice profile, parsed from the `copp profile` line in the running configuration. CoPP rate-limits traffic punted to the supervisor to protect the control plane from denial-of-service floods. Use it to confirm a protective profile is applied, for example flagging devices set to `skip`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"eigrp":{"name":"eigrp","type":"\u0019\u001bcisco.nxos.routerEigrpEntry","title":"EIGRP routing processes configured in the running config.","desc":"Obtained by running `show running-config eigrp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionService":{"name":"encryptionService","type":"\u001bcisco.nxos.encryptionServiceConfig","title":"AES (type-6) password encryption service status and master-key state.","desc":"Obtained by running `show encryption service stat`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionServiceConfig":{"name":"encryptionServiceConfig","type":"\u001bcisco.nxos.encryptionServiceConfig","title":"Cisco NX-OS encryption service configuration","desc":"State of the Type-6 (AES) password encryption service from `show encryption service stat`: whether the service is enabled, whether a master key is configured, and whether Type-6 encryption is actually in use. Lets audits confirm sensitive keys in the config are stored under strong Type-6 encryption rather than the weak reversible Type-7 cipher.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"execBanner":{"name":"execBanner","type":"\u0007","title":"Exec banner text shown after login, from `show running-config | begin \"banner exec\"`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"feature":{"name":"feature","type":"\u001bcisco.nxos.feature","title":"Cisco NX-OS licensed feature","desc":"A feature reported by `show feature` and whether it is enabled. Many NX-OS capabilities (BGP, OSPF, LACP, telnet, and so on) are packaged as features that must be enabled before use, so this is useful for confirming that risky features are disabled, for example `cisco.nxos.features.where(name == \"telnetServer\").all(state == \"disabled\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"features":{"name":"features","type":"\u0019\u001bcisco.nxos.feature","title":"Licensed features and whether each is enabled.","desc":"Command: `show feature`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"fips":{"name":"fips","type":"\u001bcisco.nxos.fipsConfig","title":"FIPS 140-2 mode status.","desc":"Obtained by running `show fips status`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"fipsConfig":{"name":"fipsConfig","type":"\u001bcisco.nxos.fipsConfig","title":"FIPS 140-2 cryptographic mode status on an NX-OS device","desc":"The Federal Information Processing Standard (FIPS) mode status, parsed from `show fips status`, reporting whether FIPS mode is configured and whether the switch is currently operating in FIPS mode. Use it to verify that devices with a FIPS compliance requirement have FIPS enabled and active.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"hostname":{"name":"hostname","type":"\u0007","title":"Configured hostname of the device, from `show running-config | section ^hostname`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hsrp":{"name":"hsrp","type":"\u0019\u001bcisco.nxos.interfaceHsrpEntry","title":"HSRP (Hot Standby Router Protocol) groups configured in the running config.","desc":"Obtained by running `show running-config hsrp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.nxos.interface","title":"Cisco NX-OS network interface","desc":"A network interface reported by `show interface`, covering physical Ethernet ports, VLAN switch virtual interfaces, port channels, tunnels, and management interfaces. Fields expose administrative and link state, addressing, speed and duplex, traffic counters, and the associated switchport and running-config settings. The name selects the interface, for example `cisco.nxos.interfaces.where(name == \"Ethernet1/1\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"interfaceHsrpEntry":{"name":"interfaceHsrpEntry","type":"\u001bcisco.nxos.interfaceHsrpEntry","title":"HSRP configuration on an NX-OS interface","desc":"The Hot Standby Router Protocol settings for one interface, parsed from `show running-config hsrp`, grouping the HSRP version and every HSRP group defined on that interface. Use it to audit gateway redundancy configuration, for example confirming version 2 is used so MD5 group authentication can be applied.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001bcisco.nxos.interface","title":"Network interfaces with operational counters and switchport configuration, from `show interface`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inventory":{"name":"inventory","type":"\u0019\u001bcisco.nxos.inventoryEntry","title":"Hardware inventory components, from `show inventory`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inventoryEntry":{"name":"inventoryEntry","type":"\u001bcisco.nxos.inventoryEntry","title":"Cisco NX-OS inventory entry","desc":"A single physical component reported by `show inventory`, such as the chassis, a supervisor or line-card module, a fan tray, or a power supply. The name selects the slot or component label, and the remaining fields carry the vendor part number, hardware version, and serial number used for asset tracking and hardware-recall audits.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ip":{"name":"ip","type":"\u001bcisco.nxos.ipConf","title":"Global IPv4 settings including source routing and DHCP snooping, from `show running-config all | sec ip`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipConf":{"name":"ipConf","type":"\u001bcisco.nxos.ipConf","title":"Cisco NX-OS IP configuration","desc":"Global IPv4 settings parsed from `show running-config all | sec ip`, covering IP source routing (a spoofing vector when enabled) and DHCP snooping, including which VLANs have snooping enabled or explicitly disabled. Useful for verifying that source routing is off and that DHCP snooping protects the intended VLANs.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ipv6":{"name":"ipv6","type":"\u001bcisco.nxos.ipv6","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ipv6RaGuardPolicy":{"name":"ipv6RaGuardPolicy","type":"\u001bcisco.nxos.ipv6.raGuardPolicyConfig","title":"IPv6 RA Guard policy, from `show ipv6 nd raguard policy`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lineConfig":{"name":"lineConfig","type":"\u001bcisco.nxos.lineConfig","title":"Cisco NX-OS terminal line configuration","desc":"Per-line access settings parsed from `show running-config all | section line`. Each entry represents a line class (console or vty) and exposes its idle timeout, concurrent-session cap, and the inbound and outbound access classes restricting which source addresses may connect. The `type` field is the selection key, for example `cisco.nxos.lineConfigs.where(type == \"vty\")`. Auditing these confirms exec timeouts and management-plane ACLs are enforced on interactive sessions.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"lineConfigs":{"name":"lineConfigs","type":"\u0019\u001bcisco.nxos.lineConfig","title":"Terminal line configurations (vty, console, aux) including exec-timeout and access-class ACLs.","desc":"Obtained by running `show running-config all | section line`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logging":{"name":"logging","type":"\u001bcisco.nxos.loggingConfig","title":"System logging (syslog) configuration and destinations.","desc":"Obtained by running `show logging info`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"loggingConfig":{"name":"loggingConfig","type":"\u001bcisco.nxos.loggingConfig","title":"Cisco NX-OS logging configuration","desc":"System logging (syslog) state from `show logging info`: the timestamp granularity, the enable state and severity threshold for each log destination (console, monitor/terminal, linecard, and remote servers), the per-facility severity levels, the configured remote syslog servers, and the source interface used for outgoing syslog traffic. Central to auditing that a device forwards logs to a remote collector at an adequate severity.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"motdBanner":{"name":"motdBanner","type":"\u0007","title":"Message-of-the-day banner text, from `show running-config | begin \"banner motd\"`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ntp":{"name":"ntp","type":"\u001bcisco.nxos.ntpConfiguration","title":"NTP configuration including servers, peers, and authentication.","desc":"Obtained by running `show running-config ntp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ntpConfiguration":{"name":"ntpConfiguration","type":"\u001bcisco.nxos.ntpConfiguration","title":"Cisco NX-OS NTP configuration","desc":"NTP client state parsed from `show running-config ntp`, listing the configured time servers and the source interface used for NTP packets. Auditing this confirms authenticated, redundant time sources are in place, for example `cisco.nxos.ntp.servers.length \u003e= 2`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ospf":{"name":"ospf","type":"\u0019\u001bcisco.nxos.routerOspfEntry","title":"OSPF routing processes configured in the running config.","desc":"Obtained by running `show running-config ospf`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passphraseDefaultTimevalues":{"name":"passphraseDefaultTimevalues","type":"\u001bcisco.nxos.passphraseTimevalues","title":"Global default passphrase aging settings applied to users without an explicit passphrase policy.","desc":"Obtained by running `show userpassphrase timevalues`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passphraseLength":{"name":"passphraseLength","type":"\u001bcisco.nxos.passphraseLengthConfig","title":"Global minimum and maximum passphrase length limits.","desc":"Obtained by running `show userpassphrase length`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passphraseLengthConfig":{"name":"passphraseLengthConfig","type":"\u001bcisco.nxos.passphraseLengthConfig","title":"Cisco NX-OS password length policy","desc":"Global password (userpassphrase) length bounds parsed from `show running-config all | include userpassphrase`. Auditing these confirms a minimum length is enforced for locally configured user passwords.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"passphraseTimevalues":{"name":"passphraseTimevalues","type":"\u001bcisco.nxos.passphraseTimevalues","title":"Cisco NX-OS passphrase aging time values","desc":"Password/passphrase aging thresholds, either the global defaults or the per-user values from the running-config. Exposes the warning, grace, and lifetime intervals so audits can verify password-expiry policy. The user field selects a specific user's values; it is null for the global defaults.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"passwordStrengthCheck":{"name":"passwordStrengthCheck","type":"\u0004","title":"Whether the password strength-check policy is enabled.","desc":"Obtained by running `show password strength-check`. True when the output reports the feature is enabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"role":{"name":"role","type":"\u001bcisco.nxos.role","title":"Cisco NX-OS RBAC role","desc":"A role-based access control (RBAC) role from `show role`, including built-in roles like network-admin and network-operator and any user-defined roles. The rules list the permit/deny statements that grant or restrict access to features, feature groups, or specific commands. Useful for auditing privilege assignments, for example `cisco.nxos.roles.where(name == \"network-admin\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"roles":{"name":"roles","type":"\u0019\u001bcisco.nxos.role","title":"RBAC roles and their permission rules.","desc":"Obtained by running `show role`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerEigrpEntry":{"name":"routerEigrpEntry","type":"\u001bcisco.nxos.routerEigrpEntry","title":"EIGRP routing process configured in the NX-OS running configuration","desc":"A `router eigrp` process parsed from `show running-config eigrp`, selected by its autonomous-system tag. Groups the per-address-family configuration (IPv4 and IPv6, including any under a VRF context) so you can audit passive-interface defaults, MD5 neighbor authentication, and adjacency-change logging across the process.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"routerOspfEntry":{"name":"routerOspfEntry","type":"\u001bcisco.nxos.routerOspfEntry","title":"OSPF routing process configured in the NX-OS running configuration","desc":"A `router ospf` process parsed from `show running-config ospf`, selected by its process tag. Exposes the router ID, passive-interface default, adjacency-change logging, and the set of interfaces bound to the process so you can audit OSPF security posture across the device.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runAaaAuthenticationLogin":{"name":"runAaaAuthenticationLogin","type":"\u0019\u001bcisco.nxos.runAaaAuthenticationLoginEntry","title":"AAA authentication login method lists (default and named).","desc":"Obtained by running `show running-config aaa | include \"authentication login\"`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runAaaAuthenticationLoginEntry":{"name":"runAaaAuthenticationLoginEntry","type":"\u001bcisco.nxos.runAaaAuthenticationLoginEntry","title":"Cisco NX-OS AAA authentication login method list","desc":"An AAA authentication login method list from `show running-config aaa | include \"authentication login\"`, either the \"default\" list or a named list. The methods define the ordered sequence of authentication sources (local, a server group, and so on) tried at login. Useful for verifying that login falls back to local authentication and does not rely on an unreachable server alone.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runAaaGroupServerRadius":{"name":"runAaaGroupServerRadius","type":"\u001bcisco.nxos.runAaaGroupServerRadius","title":"Cisco NX-OS AAA RADIUS server group","desc":"A named AAA RADIUS server group and its member servers, from `show running-config radius | section \"aaa group server\"`. Server groups order which RADIUS servers AAA method lists use for authentication, authorization, and accounting.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runAaaGroupServerTacacs":{"name":"runAaaGroupServerTacacs","type":"\u001bcisco.nxos.runAaaGroupServerTacacs","title":"Cisco NX-OS AAA TACACS+ server group","desc":"A named AAA TACACS+ server group and its member servers, from `show running-config tacacs+ | section \"aaa group server\"`. Server groups order which TACACS+ servers AAA method lists use for authentication, authorization, and accounting.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runAaaGroupsServerRadius":{"name":"runAaaGroupsServerRadius","type":"\u0019\u001bcisco.nxos.runAaaGroupServerRadius","title":"AAA RADIUS server groups and their member servers.","desc":"Obtained by running `show running-config radius | section \"aaa group server\"`. Empty when the radius feature is not enabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runAaaGroupsServerTacacs":{"name":"runAaaGroupsServerTacacs","type":"\u0019\u001bcisco.nxos.runAaaGroupServerTacacs","title":"AAA TACACS+ server groups and their member servers.","desc":"Obtained by running `show running-config tacacs+ | section \"aaa group server\"`. Empty when the tacacs+ feature is not enabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runInterfaceConfig":{"name":"runInterfaceConfig","type":"\u001bcisco.nxos.runInterfaceConfig","title":"Cisco NX-OS interface running-config security settings","desc":"Security-relevant per-interface settings parsed from `show running-config interface`, keyed by interface name. Covers DHCP snooping trust, storm control, unicast RPF, IP redirects, directed broadcast, proxy ARP, and EIGRP passive-interface state. Select an interface with the `interfaceName` field, for example `cisco.nxos.runInterfaceConfig.where(interfaceName == \"Ethernet1/1\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runInterfaces":{"name":"runInterfaces","type":"\u0019\u001bcisco.nxos.runInterfaceConfig","title":"Per-interface running-config settings (DHCP snooping trust, storm control, uRPF, ICMP redirects, proxy ARP, EIGRP passive-interface).","desc":"Obtained by running `show running-config interface`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runRadiusServer":{"name":"runRadiusServer","type":"\u001bcisco.nxos.runRadiusServer","title":"RADIUS server defined in the NX-OS running configuration","desc":"A `radius-server host` entry parsed from `show running-config radius`, exposing the server address and the shared secret used to authenticate the switch to the RADIUS AAA server. The address field selects the entry. Use it to audit that RADIUS keys are encrypted (keyType 7) rather than stored in cleartext (keyType 0).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runRadiusServers":{"name":"runRadiusServers","type":"\u0019\u001bcisco.nxos.runRadiusServer","title":"RADIUS servers configured in the running config.","desc":"Obtained by running `show running-config radius | include radius-server`. Empty when the radius feature is not enabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runTacacsServer":{"name":"runTacacsServer","type":"\u001bcisco.nxos.runTacacsServer","title":"TACACS+ server defined in the NX-OS running configuration","desc":"A `tacacs-server host` entry parsed from `show running-config tacacs+`, exposing the server address and the shared secret used to authenticate the switch to the TACACS+ AAA server. The address field selects the entry. Use it to audit that TACACS+ keys are encrypted (keyType 7) rather than stored in cleartext (keyType 0).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"runTacacsServers":{"name":"runTacacsServers","type":"\u0019\u001bcisco.nxos.runTacacsServer","title":"TACACS+ servers configured in the running config.","desc":"Obtained by running `show running-config tacacs+ | include tacacs-server`. Empty when the tacacs+ feature is not enabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"scheduler":{"name":"scheduler","type":"\u001bcisco.nxos.scheduler","title":"NX-OS command scheduler configuration","desc":"The device command scheduler, parsed from `show scheduler config`, which runs configured jobs (batches of CLI commands) at scheduled times. Exposes the log-file size limit plus the defined schedules and jobs. Use it to review automated maintenance tasks, for example confirming a configuration-backup job is scheduled.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"schedulerConfig":{"name":"schedulerConfig","type":"\u001bcisco.nxos.scheduler","title":"Command scheduler jobs and schedules.","desc":"Obtained by running `show scheduler config`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"snmp":{"name":"snmp","type":"\u001bcisco.nxos.snmpConfiguration","title":"SNMP configuration including communities, users, hosts, and traps.","desc":"Obtained by running `show running-config snmp`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"snmpConfiguration":{"name":"snmpConfiguration","type":"\u001bcisco.nxos.snmpConfiguration","title":"Cisco NX-OS SNMP configuration","desc":"SNMP agent state parsed from `show running-config snmp`, covering global settings, SNMPv3 users and their authentication and privacy parameters, SNMPv1/v2c communities, notification host receivers, and the per-event trap enablement matrix. Auditing these detects weak or absent auth on SNMPv3, cleartext community strings, and unrestricted notification targets. For example `cisco.nxos.snmp.communities.where(ipv4Acl == \"\")` finds communities with no ACL restriction.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"ssh":{"name":"ssh","type":"\u001bcisco.nxos.sshConfig","title":"SSH server key algorithm and key size.","desc":"Obtained by running `show running-config | include ssh`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sshConfig":{"name":"sshConfig","type":"\u001bcisco.nxos.sshConfig","title":"Cisco NX-OS SSH host key configuration","desc":"SSH host key parameters from the running-config `ssh key` line: the key algorithm and, where applicable, the modulus size. Lets audits flag weak or undersized SSH host keys (for example RSA below 2048 bits or the legacy DSA algorithm).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"sshLoginAttemptsLimit":{"name":"sshLoginAttemptsLimit","type":"\u0005","title":"Maximum number of SSH login attempts allowed before the connection is dropped.","desc":"Obtained by running `show running-config security all | include \"ssh login-attempts\"`. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"switchportConfig":{"name":"switchportConfig","type":"\u001bcisco.nxos.switchportConfig","title":"Cisco NX-OS switchport configuration","desc":"Layer-2 switchport settings for an interface, from `show interface switchport`. Reports whether the port operates as a switchport, whether it is a monitor (SPAN) port, and its operational mode (access, trunk, or similar).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"systemLogin":{"name":"systemLogin","type":"\u001bcisco.nxos.systemLoginConfiguration","title":"System login lockout policy (block duration, attempt count, and observation window).","desc":"Obtained by running `show running-config | include \"system login\"`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"systemLoginConfiguration":{"name":"systemLoginConfiguration","type":"\u001bcisco.nxos.systemLoginConfiguration","title":"Cisco NX-OS login lockout configuration","desc":"Automatic login-blocking policy set with `system login block-for` (the `login block-for` command on releases before NX-OS 7.0(3)I6(1)), parsed from `show running-config | include \"system login\"`. When the number of failed authentications reaches `attempts` inside the `within` window, the device enters a quiet period of `blockFor` seconds during which all Telnet and SSH logins are denied. The feature is disabled by default, so all three fields are null when it is not configured. Use it to confirm brute-force protection is present, for example `cisco.nxos.systemLogin.where(blockFor \u003e 0)`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"user":{"name":"user","type":"\u001bcisco.nxos.user","title":"Cisco NX-OS local user account","desc":"A locally defined user account parsed from `show running-config | include username`, with its stored credentials (password hashes and SSH keys), assigned role, and passphrase aging settings. Useful for auditing local accounts, credential encryption, and role assignments, for example `cisco.nxos.users.where(username != \"admin\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"userPassphraseTimevalues":{"name":"userPassphraseTimevalues","type":"\u0019\u001bcisco.nxos.passphraseTimevalues","title":"Per-user passphrase aging settings (lifetime, warning, grace).","desc":"Obtained by running `show running-config | include passphrase`. A user missing from the output uses the global default time values.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"users":{"name":"users","type":"\u0019\u001bcisco.nxos.user","title":"Locally defined user accounts with their credentials and roles.","desc":"Obtained by running `show running-config | include username`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS network operating system","desc":"Configuration and operational state of a device running Cisco NX-OS (Nexus data-center switches), collected by running `show` commands over the device connection. Fields cover the hostname, interfaces, users and roles, licensed features, TACACS+/RADIUS servers and AAA server groups, Control Plane Policing (CoPP), routing (BGP, OSPF, EIGRP, HSRP), the command scheduler, FIPS and boot settings, SSH, logging, SNMP, NTP, ACLs, password strength checking, passphrase and password-length policy, DHCP snooping, IPv6 RA Guard, line (vty and console) hardening, and login lockout. Use it to audit the security posture of a Nexus switch, for example `cisco.nxos.features.where(name == \"telnetServer\").all(state == \"disabled\")`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.accessControlList":{"id":"cisco.nxos.accessControlList","name":"cisco.nxos.accessControlList","fields":{"entries":{"name":"entries","type":"\u0019\u001bcisco.nxos.accessControlList.entry","is_mandatory":true,"title":"Ordered ACL entries (rules)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"entry":{"name":"entry","type":"\u001bcisco.nxos.accessControlList.entry","title":"Cisco NX-OS access control list entry","desc":"A single rule within an ACL, keyed by sequence number. Exposes the action, protocol, source and destination (parsed into address and wildcard where present), any port match, and remarks. Lets audits find overly permissive rules, for example a `permit ip any any`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"ACL name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ACL type","desc":"One of `ip`, `ipv6`, or `mac` (lowercased).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS access control list (ACL)","desc":"A single ACL from `show access-lists`, keyed by name and type, with its ordered entries. Lets audits inspect filtering rules applied to interfaces, VTY lines, and other features. Select one with the name field, for example `cisco.nxos.accessControlList.where(name == \"MGMT-IN\")`.","private":true,"defaults":"name type","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.accessControlList.entry":{"id":"cisco.nxos.accessControlList.entry","name":"cisco.nxos.accessControlList.entry","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Rule action","desc":"Typically `permit` or `deny`. Remark-only lines carry no action and expose their text through remark instead.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"destination":{"name":"destination","type":"\u0007","is_mandatory":true,"title":"Raw destination match token as it appears in the rule","desc":"The unparsed destination, which may be an IP with mask, a MAC address, an `addrgroup \u003cname\u003e` reference, or the `any` keyword.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"destinationAddress":{"name":"destinationAddress","type":"\u0007","is_mandatory":true,"title":"Parsed destination address portion of destination","desc":"The address (or `any`) split out from destination. Null when destination has no separable address.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"destinationWildcard":{"name":"destinationWildcard","type":"\u0007","is_mandatory":true,"title":"Parsed destination wildcard mask","desc":"The wildcard/mask split out from destination when present. Null otherwise.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"modifiers":{"name":"modifiers","type":"\u0007","is_mandatory":true,"title":"Additional rule modifiers","desc":"Trailing options captured after the core match, such as MAC protocol (EtherType) keywords or other per-entry qualifiers.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"port":{"name":"port","type":"\u0007","is_mandatory":true,"title":"Port match expression","desc":"From the port operator on the rule, one of `eq \u003cport\u003e`, `gt \u003cport\u003e`, `lt \u003cport\u003e`, or `neq \u003cport\u003e`. Empty when the rule has no port match.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Layer-3/4 protocol matched","desc":"For example `ip`, `tcp`, `udp`, `icmp`, `icmpv6`, or a numeric protocol (lowercased). Empty for MAC ACL entries, which match by MAC/EtherType.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"remark":{"name":"remark","type":"\u0007","is_mandatory":true,"title":"Remark (comment) text for this entry","desc":"Set for `remark` lines; empty for match rules.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"seq":{"name":"seq","type":"\u0005","is_mandatory":true,"title":"Sequence number ordering this entry within the ACL","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Raw source match token as it appears in the rule","desc":"The unparsed source, which may be an IP with mask, a MAC address, an `addrgroup \u003cname\u003e` reference, or the `any` keyword.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceAddress":{"name":"sourceAddress","type":"\u0007","is_mandatory":true,"title":"Parsed source address portion of source","desc":"The address (or `any`) split out from source. Null when source has no separable address (for example a MAC ACL or addrgroup reference).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceWildcard":{"name":"sourceWildcard","type":"\u0007","is_mandatory":true,"title":"Parsed source wildcard mask","desc":"The wildcard/mask split out from source when present. Null otherwise.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS access control list entry","desc":"A single rule within an ACL, keyed by sequence number. Exposes the action, protocol, source and destination (parsed into address and wildcard where present), any port match, and remarks. Lets audits find overly permissive rules, for example a `permit ip any any`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.bgpRouterConfig":{"id":"cisco.nxos.bgpRouterConfig","name":"cisco.nxos.bgpRouterConfig","fields":{"as":{"name":"as","type":"\u0005","is_mandatory":true,"title":"BGP Autonomous System (AS) number","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logNeighborChanges":{"name":"logNeighborChanges","type":"\u0004","is_mandatory":true,"title":"Whether neighbor state-change logging is enabled","desc":"True when `log-neighbor-changes` is present, so adjacency up/down transitions are logged.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"neighbor":{"name":"neighbor","type":"\u001bcisco.nxos.bgpRouterConfig.neighbor","title":"Cisco NX-OS BGP neighbor","desc":"A single configured BGP peer under a `router bgp` process. Exposes the peer address or peer-group name, the remote AS, the session password and its encryption type, and the per-neighbor address families. Lets audits confirm every peering uses authentication.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"neighbors":{"name":"neighbors","type":"\u0019\u001bcisco.nxos.bgpRouterConfig.neighbor","is_mandatory":true,"title":"Configured BGP neighbors (peers) for this AS","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerId":{"name":"routerId","type":"\u000f","is_mandatory":true,"title":"BGP router ID (IPv4 address)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS BGP router configuration","desc":"A single `router bgp` process from `show running-config bgp`, keyed by autonomous system number. Exposes the router ID, neighbor-change logging, and the configured neighbors with their authentication and address families. Central to auditing BGP session authentication and peering.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.bgpRouterConfig.neighbor":{"id":"cisco.nxos.bgpRouterConfig.neighbor","name":"cisco.nxos.bgpRouterConfig.neighbor","fields":{"addressFamilies":{"name":"addressFamilies","type":"\u0019\u001bcisco.nxos.bgpRouterConfig.neighbor.af","is_mandatory":true,"title":"Per-neighbor address families","desc":"The `address-family` blocks configured for this peer, each with its inbound/outbound route maps.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"af":{"name":"af","type":"\u001bcisco.nxos.bgpRouterConfig.neighbor.af","title":"Cisco NX-OS BGP neighbor address family","desc":"A single `address-family` block under a BGP neighbor. Exposes the family and the route maps applied inbound and outbound, so audits can inspect route filtering policy per peer.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Configured session password value (as stored, per keyType)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyType":{"name":"keyType","type":"\u0005","is_mandatory":true,"title":"Password encryption type","desc":"The type digit from `neighbor ... password \u003ctype\u003e \u003cvalue\u003e`. `0` is an unencrypted (cleartext) password, `3` is 3DES-encrypted, and `7` is a Cisco type-7 encrypted password. Null when no session password is set.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"neighbor":{"name":"neighbor","type":"\u0007","is_mandatory":true,"title":"Neighbor identifier","desc":"The peer IPv4/IPv6 address or peer-group name from the `neighbor` line.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"remoteAs":{"name":"remoteAs","type":"\u0005","is_mandatory":true,"title":"Remote AS number of the peer","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS BGP neighbor","desc":"A single configured BGP peer under a `router bgp` process. Exposes the peer address or peer-group name, the remote AS, the session password and its encryption type, and the per-neighbor address families. Lets audits confirm every peering uses authentication.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.bgpRouterConfig.neighbor.af":{"id":"cisco.nxos.bgpRouterConfig.neighbor.af","name":"cisco.nxos.bgpRouterConfig.neighbor.af","fields":{"inRouteMap":{"name":"inRouteMap","type":"\u0007","is_mandatory":true,"title":"Name of the inbound route map applied to this family","desc":"From `route-map \u003cname\u003e in`. Empty when no inbound route map is set.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outRouteMap":{"name":"outRouteMap","type":"\u0007","is_mandatory":true,"title":"Name of the outbound route map applied to this family","desc":"From `route-map \u003cname\u003e out`. Empty when no outbound route map is set.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Address family protocol","desc":"Either `ipv4` or `ipv6`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Address family subtype","desc":"One of `unicast`, `multicast`, `labeled-unicast`, `vpnv4`, or `vpnv6`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS BGP neighbor address family","desc":"A single `address-family` block under a BGP neighbor. Exposes the family and the route maps applied inbound and outbound, so audits can inspect route filtering policy per peer.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.bootConfig":{"id":"cisco.nxos.bootConfig","name":"cisco.nxos.bootConfig","fields":{"bootOrder":{"name":"bootOrder","type":"\u0007","is_mandatory":true,"title":"Boot device order from `boot order`","desc":"Either `bootflash` (boot the local image first) or `pxe bootflash` (attempt a PXE network boot before falling back to bootflash). When the `boot order` line is absent, `bootflash` is the implied default.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"imageUri":{"name":"imageUri","type":"\u0007","is_mandatory":true,"title":"NX-OS software image loaded from bootflash","desc":"The image URI from the `boot nxos` line, for example `bootflash:/nxos.9.3.10.bin`. Empty when no boot image is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"poapEnabled":{"name":"poapEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Power-On Auto Provisioning (POAP) is enabled (`boot poap enable`)","desc":"POAP lets an unconfigured switch download its image and configuration from the network at first boot. Leaving it enabled on a production device is an integrity risk, since a rogue DHCP/script server could push arbitrary config.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS boot configuration","desc":"Boot behavior parsed from the running-config `boot` lines: the boot device order, whether Power-On Auto Provisioning (POAP) is armed, and the NX-OS software image loaded from bootflash. Useful for confirming a device boots its intended image and does not fall back to an unattended network install.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.cdpAllEntry":{"id":"cisco.nxos.cdpAllEntry","name":"cisco.nxos.cdpAllEntry","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether CDP is enabled on this interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"enabledGlobal":{"name":"enabledGlobal","type":"\u0004","is_mandatory":true,"title":"Whether CDP is enabled globally on the device","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"holdTime":{"name":"holdTime","type":"\u0005","is_mandatory":true,"title":"CDP hold time in seconds","desc":"How long a neighbor retains received CDP information before discarding it. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.interface","is_mandatory":true,"title":"Interface this CDP status applies to","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"refreshTime":{"name":"refreshTime","type":"\u0005","is_mandatory":true,"title":"CDP advertisement refresh interval in seconds","desc":"How often CDP advertisements are sent. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Interface operational status","desc":"For example `up` or `down`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS CDP status for an interface","desc":"Per-interface Cisco Discovery Protocol state from `show cdp all`: whether CDP is enabled on the interface and globally, the interface operational status, and the advertisement refresh and hold timers. Lets audits flag interfaces where CDP (which leaks device and topology details to neighbors) is still on.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.clockConfiguration":{"id":"cisco.nxos.clockConfiguration","name":"cisco.nxos.clockConfiguration","fields":{"offsetHours":{"name":"offsetHours","type":"\u0005","is_mandatory":true,"title":"Hours component of the timezone offset from UTC; may be positive or negative","desc":"Defaults to 0 when no timezone is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"offsetMinutes":{"name":"offsetMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes component of the timezone offset from UTC; always non-negative","desc":"Defaults to 0 when no timezone is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"summerTimeConfigured":{"name":"summerTimeConfigured","type":"\u0004","is_mandatory":true,"title":"Whether daylight saving time (DST) is configured via `clock summer-time`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"timezone":{"name":"timezone","type":"\u0007","is_mandatory":true,"title":"Timezone name set with `clock timezone`, for example UTC, PST, or EST","desc":"Defaults to UTC when no timezone is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS clock and timezone configuration","desc":"Timezone and daylight-saving settings parsed from `show running-config all | include clock`. Covers the timezone name, its offset from UTC in hours and minutes, and whether summer-time (DST) is configured. When no clock config is present the device is on UTC with a zero offset and DST off, which is what these fields default to.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.coppConfig":{"id":"cisco.nxos.coppConfig","name":"cisco.nxos.coppConfig","fields":{"profile":{"name":"profile","type":"\u0007","is_mandatory":true,"title":"CoPP profile name","desc":"One of strict (the default, and the most aggressive), moderate, lenient, or dense, which apply progressively larger burst sizes and smaller committed information rates, or skip, which applies no control-plane policy at all and is not recommended.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Control Plane Policing (CoPP) profile applied on the device","desc":"The active CoPP built-in best-practice profile, parsed from the `copp profile` line in the running configuration. CoPP rate-limits traffic punted to the supervisor to protect the control plane from denial-of-service floods. Use it to confirm a protective profile is applied, for example flagging devices set to `skip`.","private":true,"defaults":"profile","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.encryptionServiceConfig":{"id":"cisco.nxos.encryptionServiceConfig","name":"cisco.nxos.encryptionServiceConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the encryption service is enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"masterKeyConfigured":{"name":"masterKeyConfigured","type":"\u0004","is_mandatory":true,"title":"Whether a master key is configured","desc":"The master key is required before Type-6 encryption can protect stored secrets.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type6EncryptionUsed":{"name":"type6EncryptionUsed","type":"\u0004","is_mandatory":true,"title":"Whether Type-6 encryption is currently in use","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS encryption service configuration","desc":"State of the Type-6 (AES) password encryption service from `show encryption service stat`: whether the service is enabled, whether a master key is configured, and whether Type-6 encryption is actually in use. Lets audits confirm sensitive keys in the config are stored under strong Type-6 encryption rather than the weak reversible Type-7 cipher.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.feature":{"id":"cisco.nxos.feature","name":"cisco.nxos.feature","fields":{"instance":{"name":"instance","type":"\u0005","is_mandatory":true,"title":"Instance number of the feature, for features that support multiple instances.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Feature name as shown by `show feature`, for example \"bgp\", \"ospf\", or \"telnetServer\".","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Feature state. One of `enabled`, `disabled`, or `enabled (not-running)`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS licensed feature","desc":"A feature reported by `show feature` and whether it is enabled. Many NX-OS capabilities (BGP, OSPF, LACP, telnet, and so on) are packaged as features that must be enabled before use, so this is useful for confirming that risky features are disabled, for example `cisco.nxos.features.where(name == \"telnetServer\").all(state == \"disabled\")`.","private":true,"defaults":"name state","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.fipsConfig":{"id":"cisco.nxos.fipsConfig","name":"cisco.nxos.fipsConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether FIPS mode is enabled in the configuration (`FIPS Status: enabled`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inUse":{"name":"inUse","type":"\u0004","is_mandatory":true,"title":"Whether the switch is currently operating in FIPS mode (`Switch Mode: FIPS`); may differ from enabled until a reload completes the transition","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"FIPS 140-2 cryptographic mode status on an NX-OS device","desc":"The Federal Information Processing Standard (FIPS) mode status, parsed from `show fips status`, reporting whether FIPS mode is configured and whether the switch is currently operating in FIPS mode. Use it to verify that devices with a FIPS compliance requirement have FIPS enabled and active.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.interface":{"id":"cisco.nxos.interface","name":"cisco.nxos.interface","fields":{"adminState":{"name":"adminState","type":"\u0007","is_mandatory":true,"title":"Administrative state configured on the interface, either \"up\" or \"down\" (shutdown)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bandwidth":{"name":"bandwidth","type":"\u0007","is_mandatory":true,"title":"Configured or negotiated bandwidth of the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"bia":{"name":"bia","type":"\u0007","is_mandatory":true,"title":"Burned-in (hardware) MAC address of the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Interface description text configured on the port","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"duplex":{"name":"duplex","type":"\u0007","is_mandatory":true,"title":"Duplex setting, \"full\" or \"half\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encapsulation":{"name":"encapsulation","type":"\u0007","is_mandatory":true,"title":"Layer-2 encapsulation type, for example \"ARPA\" or \"802.1Q Virtual LAN\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hardwareType":{"name":"hardwareType","type":"\u0007","is_mandatory":true,"title":"Hardware type of the interface, for example \"Ethernet\", \"EtherSVI\" (VLAN), or \"Tunnel\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputErrors":{"name":"inputErrors","type":"\u0007","is_mandatory":true,"title":"Cumulative count of input errors on the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputPackets":{"name":"inputPackets","type":"\u0007","is_mandatory":true,"title":"Cumulative count of packets received on the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"inputRate":{"name":"inputRate","type":"\u0007","is_mandatory":true,"title":"Input bit rate observed over the load interval","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"IPv4 address assigned to the interface, with prefix length","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"linkStatus":{"name":"linkStatus","type":"\u0007","is_mandatory":true,"title":"Operational link status, typically \"up\", \"down\", or a down reason","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"macAddress":{"name":"macAddress","type":"\u0007","is_mandatory":true,"title":"Currently active MAC address of the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Layer-2 mode of the port, for example \"access\" or \"trunk\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"mtu":{"name":"mtu","type":"\u0007","is_mandatory":true,"title":"Maximum transmission unit in bytes","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name, for example \"Ethernet1/1\", \"Vlan10\", or \"mgmt0\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputErrors":{"name":"outputErrors","type":"\u0007","is_mandatory":true,"title":"Cumulative count of output errors on the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputPackets":{"name":"outputPackets","type":"\u0007","is_mandatory":true,"title":"Cumulative count of packets sent on the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"outputRate":{"name":"outputRate","type":"\u0007","is_mandatory":true,"title":"Output bit rate observed over the load interval","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"runningConfig":{"name":"runningConfig","type":"\u001bcisco.nxos.runInterfaceConfig","title":"Running-config settings for this interface, from `show running-config interface`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"speed":{"name":"speed","type":"\u0007","is_mandatory":true,"title":"Interface speed, for example \"1000 Mb/s\" or \"auto\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"switchportConfig":{"name":"switchportConfig","type":"\u001bcisco.nxos.switchportConfig","is_mandatory":true,"title":"Switchport settings for this interface, from `show interface switchport`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vlanId":{"name":"vlanId","type":"\u0007","is_mandatory":true,"title":"VLAN ID for VLAN switch virtual interfaces","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS network interface","desc":"A network interface reported by `show interface`, covering physical Ethernet ports, VLAN switch virtual interfaces, port channels, tunnels, and management interfaces. Fields expose administrative and link state, addressing, speed and duplex, traffic counters, and the associated switchport and running-config settings. The name selects the interface, for example `cisco.nxos.interfaces.where(name == \"Ethernet1/1\")`.","private":true,"defaults":"name linkStatus","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.interfaceHsrpEntry":{"id":"cisco.nxos.interfaceHsrpEntry","name":"cisco.nxos.interfaceHsrpEntry","fields":{"groups":{"name":"groups","type":"\u0019\u001bcisco.nxos.interfaceHsrpEntry.hsrpGroup","is_mandatory":true,"title":"HSRP groups configured on this interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hsrpGroup":{"name":"hsrpGroup","type":"\u001bcisco.nxos.interfaceHsrpEntry.hsrpGroup","title":"HSRP group on an NX-OS interface","desc":"A single HSRP standby group defined under an interface, identified by its group number and address family, together with the authentication configured for the group. HSRP supports MD5 key-string, MD5 keychain, or plaintext authentication. Use it to flag groups using plaintext authentication or an unencrypted (type 0) MD5 key string.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"hsrpInterface":{"name":"hsrpInterface","type":"\u001bcisco.nxos.interface","title":"Interface resource this HSRP configuration is attached to, resolved by interfaceName, null when no matching interface is found","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interfaceName":{"name":"interfaceName","type":"\u0007","is_mandatory":true,"title":"Interface name the HSRP configuration is applied to (e.g. Ethernet1/43)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"HSRP version in use: 1 (default, IPv4 only) or 2 (required for IPv6 and for MD5 group authentication)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"HSRP configuration on an NX-OS interface","desc":"The Hot Standby Router Protocol settings for one interface, parsed from `show running-config hsrp`, grouping the HSRP version and every HSRP group defined on that interface. Use it to audit gateway redundancy configuration, for example confirming version 2 is used so MD5 group authentication can be applied.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.interfaceHsrpEntry.hsrpGroup":{"id":"cisco.nxos.interfaceHsrpEntry.hsrpGroup","name":"cisco.nxos.interfaceHsrpEntry.hsrpGroup","fields":{"authenticationText":{"name":"authenticationText","type":"\u0007","is_mandatory":true,"title":"Plaintext authentication string, empty when text authentication is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"groupId":{"name":"groupId","type":"\u0005","is_mandatory":true,"title":"HSRP group number identifying the group on the interface","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationKey":{"name":"md5AuthenticationKey","type":"\u0007","is_mandatory":true,"title":"MD5 key string used for group authentication, empty when MD5 key-string authentication is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationKeyType":{"name":"md5AuthenticationKeyType","type":"\u0005","is_mandatory":true,"title":"Encryption type of the MD5 key string: 0 for cleartext (the default when omitted) or 7 for Cisco type-7 encryption","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationKeychain":{"name":"md5AuthenticationKeychain","type":"\u0007","is_mandatory":true,"title":"Name of the keychain supplying MD5 authentication keys, empty when key-chain authentication is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Address family of the group: ipv4 (the default when omitted in config) or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"HSRP group on an NX-OS interface","desc":"A single HSRP standby group defined under an interface, identified by its group number and address family, together with the authentication configured for the group. HSRP supports MD5 key-string, MD5 keychain, or plaintext authentication. Use it to flag groups using plaintext authentication or an unencrypted (type 0) MD5 key string.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.inventoryEntry":{"id":"cisco.nxos.inventoryEntry","name":"cisco.nxos.inventoryEntry","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable component description reported in the DESCR column","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Component slot or label reported in the NAME column, for example \"Chassis\", \"Slot 1\", or \"Fan 1\"","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"partNumber":{"name":"partNumber","type":"\u0007","is_mandatory":true,"title":"Manufacturer product ID (part number) reported in the PID column","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"productVersion":{"name":"productVersion","type":"\u0007","is_mandatory":true,"title":"Hardware version identifier reported in the VID column","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Component serial number reported in the SN column","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS inventory entry","desc":"A single physical component reported by `show inventory`, such as the chassis, a supervisor or line-card module, a fan tray, or a power supply. The name selects the slot or component label, and the remaining fields carry the vendor part number, hardware version, and serial number used for asset tracking and hardware-recall audits.","private":true,"defaults":"name description","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.ipConf":{"id":"cisco.nxos.ipConf","name":"cisco.nxos.ipConf","fields":{"dhcpSnoopingDisabledVlanIds":{"name":"dhcpSnoopingDisabledVlanIds","type":"\u0019\u0005","is_mandatory":true,"title":"VLAN IDs for which DHCP snooping is explicitly disabled (`no ip dhcp snooping vlan`), expanded from any configured ranges.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"dhcpSnoopingDisabledVlanInterfaces":{"name":"dhcpSnoopingDisabledVlanInterfaces","type":"\u0019\u001bcisco.nxos.interface","title":"VLAN switch virtual interfaces (Vlan\u003cid\u003e) for which DHCP snooping is explicitly disabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"dhcpSnoopingEnabled":{"name":"dhcpSnoopingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether DHCP snooping is globally enabled (`ip dhcp snooping`).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"dhcpSnoopingVlanIds":{"name":"dhcpSnoopingVlanIds","type":"\u0019\u0005","is_mandatory":true,"title":"VLAN IDs for which DHCP snooping is enabled, expanded from any configured ranges.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"dhcpSnoopingVlanInterfaces":{"name":"dhcpSnoopingVlanInterfaces","type":"\u0019\u001bcisco.nxos.interface","title":"VLAN switch virtual interfaces (Vlan\u003cid\u003e) for which DHCP snooping is enabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceRouteEnabled":{"name":"sourceRouteEnabled","type":"\u0004","is_mandatory":true,"title":"Whether IP source routing is enabled (`ip source-route`). Enabled source routing is a spoofing risk and is typically disabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS IP configuration","desc":"Global IPv4 settings parsed from `show running-config all | sec ip`, covering IP source routing (a spoofing vector when enabled) and DHCP snooping, including which VLANs have snooping enabled or explicitly disabled. Useful for verifying that source routing is off and that DHCP snooping protects the intended VLANs.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.ipv6":{"id":"cisco.nxos.ipv6","fields":{"raGuardPolicyConfig":{"name":"raGuardPolicyConfig","type":"\u001bcisco.nxos.ipv6.raGuardPolicyConfig","title":"Cisco NX-OS IPv6 RA Guard policy","desc":"A named IPv6 Router Advertisement (RA) Guard policy from `show ipv6 nd raguard policy`, which validates or blocks IPv6 RA and redirect messages received on ports to defend against rogue-router and man-in-the-middle attacks. Fields expose the device role, hop-count bounds, the required state of the RA managed/other config flags, whether the port is trusted, and the maximum router preference the policy accepts.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"cisco.nxos.ipv6.raGuardPolicyConfig":{"id":"cisco.nxos.ipv6.raGuardPolicyConfig","name":"cisco.nxos.ipv6.raGuardPolicyConfig","fields":{"deviceRole":{"name":"deviceRole","type":"\u0007","is_mandatory":true,"title":"Port role the policy enforces. Either `host` (blocks all RAs and redirects) or `router` (allows RAs from a legitimate router).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hopLimitType":{"name":"hopLimitType","type":"\u0007","is_mandatory":true,"title":"Which hop-count bound the policy checks against the RA. Either `minimum` or `maximum`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"hopLimitValue":{"name":"hopLimitValue","type":"\u0005","is_mandatory":true,"title":"Hop-count limit value verified against the RA's Cur Hop Limit field.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"managedConfigFlag":{"name":"managedConfigFlag","type":"\u0007","is_mandatory":true,"title":"Required state of the RA managed-address-configuration (M) flag. Either `on` or `off`.","desc":"Empty when the policy does not verify this flag.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"otherConfigFlag":{"name":"otherConfigFlag","type":"\u0007","is_mandatory":true,"title":"Required state of the RA other-configuration (O) flag. Either `on` or `off`.","desc":"Empty when the policy does not verify this flag.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"policyName":{"name":"policyName","type":"\u0007","is_mandatory":true,"title":"Name of the RA Guard policy.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerPreferenceMaximum":{"name":"routerPreferenceMaximum","type":"\u0007","is_mandatory":true,"title":"Maximum router preference the policy accepts in the RA Default Router Preference field. One of `low`, `medium`, or `high`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trustedPort":{"name":"trustedPort","type":"\u0004","is_mandatory":true,"title":"Whether the trusted-port setting is enabled, which disables RA filtering on ports connected to a trusted router.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS IPv6 RA Guard policy","desc":"A named IPv6 Router Advertisement (RA) Guard policy from `show ipv6 nd raguard policy`, which validates or blocks IPv6 RA and redirect messages received on ports to defend against rogue-router and man-in-the-middle attacks. Fields expose the device role, hop-count bounds, the required state of the RA managed/other config flags, whether the port is trusted, and the maximum router preference the policy accepts.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.lineConfig":{"id":"cisco.nxos.lineConfig","name":"cisco.nxos.lineConfig","fields":{"accessClassIn":{"name":"accessClassIn","type":"\u001bcisco.nxos.accessControlList","title":"Inbound access class (ACL) restricting which sources may connect on this line, resolved from accessClassInName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"accessClassInName":{"name":"accessClassInName","type":"\u0007","is_mandatory":true,"title":"Name of the inbound access class (ACL) restricting which sources may connect on this line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"accessClassOut":{"name":"accessClassOut","type":"\u001bcisco.nxos.accessControlList","title":"Outbound access class (ACL) restricting outgoing connections from this line, resolved from accessClassOutName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"accessClassOutName":{"name":"accessClassOutName","type":"\u0007","is_mandatory":true,"title":"Name of the outbound access class (ACL) restricting outgoing connections from this line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"execTimeout":{"name":"execTimeout","type":"\u0005","is_mandatory":true,"title":"Idle exec timeout in minutes before an inactive session is disconnected; 0 disables the timeout","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sessionLimit":{"name":"sessionLimit","type":"\u0005","is_mandatory":true,"title":"Maximum number of concurrent sessions permitted on this line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Line class this configuration applies to, either `vty` (network sessions) or `console`","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS terminal line configuration","desc":"Per-line access settings parsed from `show running-config all | section line`. Each entry represents a line class (console or vty) and exposes its idle timeout, concurrent-session cap, and the inbound and outbound access classes restricting which source addresses may connect. The `type` field is the selection key, for example `cisco.nxos.lineConfigs.where(type == \"vty\")`. Auditing these confirms exec timeouts and management-plane ACLs are enforced on interactive sessions.","private":true,"defaults":"type","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.loggingConfig":{"id":"cisco.nxos.loggingConfig","name":"cisco.nxos.loggingConfig","fields":{"consoleEnabled":{"name":"consoleEnabled","type":"\u0004","is_mandatory":true,"title":"Whether console logging is enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"consoleSeverity":{"name":"consoleSeverity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for console logging","desc":"The lowest-priority level that is logged to the console. One of `emergencies` (0), `alerts` (1), `critical` (2), `errors` (3), `warnings` (4), `notifications` (5), `information` (6), or `debugging` (7). Null when console logging is disabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"facilities":{"name":"facilities","type":"\u0019\u001bcisco.nxos.loggingConfig.facility","is_mandatory":true,"title":"Per-facility severity levels","desc":"The default and current severity for each software component (facility), as reported in the facility table of `show logging info`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"facility":{"name":"facility","type":"\u001bcisco.nxos.loggingConfig.facility","title":"Cisco NX-OS logging facility","desc":"The severity configuration for one software component (facility) from the facility table of `show logging info`. Lets audits verify that a specific subsystem logs at the required detail level.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"linecardEnabled":{"name":"linecardEnabled","type":"\u0004","is_mandatory":true,"title":"Whether linecard logging is enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"linecardSeverity":{"name":"linecardSeverity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for linecard logging","desc":"The lowest-priority level logged from linecards. One of `emergencies` (0), `alerts` (1), `critical` (2), `errors` (3), `warnings` (4), `notifications` (5), `information` (6), or `debugging` (7). Null when linecard logging is disabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"monitorEnabled":{"name":"monitorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether monitor (terminal/vty) logging is enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"monitorSeverity":{"name":"monitorSeverity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for monitor (terminal/vty) logging","desc":"The lowest-priority level logged to monitor sessions. One of `emergencies` (0), `alerts` (1), `critical` (2), `errors` (3), `warnings` (4), `notifications` (5), `information` (6), or `debugging` (7). Null when monitor logging is disabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"remoteServers":{"name":"remoteServers","type":"\u0019\u001bcisco.nxos.loggingConfig.server","is_mandatory":true,"title":"Configured remote syslog servers","desc":"Each entry is one `logging server` destination, with its address, port, VRF, facility, and per-server severity threshold.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"server":{"name":"server","type":"\u001bcisco.nxos.loggingConfig.server","title":"Cisco NX-OS remote syslog server","desc":"A single `logging server` destination from `show logging info`, keyed by server address and facility. Exposes where logs are sent and at what severity, so audits can confirm a device forwards to an approved collector.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"serverEnabled":{"name":"serverEnabled","type":"\u0004","is_mandatory":true,"title":"Whether remote syslog server logging is enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"srcInterface":{"name":"srcInterface","type":"\u001bcisco.nxos.interface","title":"Source interface for outgoing syslog packets","desc":"The interface identified by srcInterfaceName, resolved to the matching NX-OS interface. Null when no source interface is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"srcInterfaceName":{"name":"srcInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the source interface for outgoing syslog packets","desc":"The interface whose address is used as the source for packets sent to remote logging servers, set by `logging source-interface`. Empty when no source interface is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"timestampFormat":{"name":"timestampFormat","type":"\u0007","is_mandatory":true,"title":"Timestamp granularity attached to log messages","desc":"One of `Seconds`, `MilliSeconds`, or `MicroSeconds`, set by `logging timestamp`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS logging configuration","desc":"System logging (syslog) state from `show logging info`: the timestamp granularity, the enable state and severity threshold for each log destination (console, monitor/terminal, linecard, and remote servers), the per-facility severity levels, the configured remote syslog servers, and the source interface used for outgoing syslog traffic. Central to auditing that a device forwards logs to a remote collector at an adequate severity.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.loggingConfig.facility":{"id":"cisco.nxos.loggingConfig.facility","name":"cisco.nxos.loggingConfig.facility","fields":{"currentSeverity":{"name":"currentSeverity","type":"\u0007","is_mandatory":true,"title":"Currently configured severity level for this facility","desc":"The active session threshold, which may differ from the default when overridden by `logging level`. One of `emergencies` (0), `alerts` (1), `critical` (2), `errors` (3), `warnings` (4), `notifications` (5), `information` (6), or `debugging` (7).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"defaultSeverity":{"name":"defaultSeverity","type":"\u0007","is_mandatory":true,"title":"Default severity level for this facility","desc":"The factory-default threshold. One of `emergencies` (0), `alerts` (1), `critical` (2), `errors` (3), `warnings` (4), `notifications` (5), `information` (6), or `debugging` (7).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Facility (software component) name generating logs","desc":"For example `aaa`, `acllog`, `arp`, or `auth`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS logging facility","desc":"The severity configuration for one software component (facility) from the facility table of `show logging info`. Lets audits verify that a specific subsystem logs at the required detail level.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.loggingConfig.server":{"id":"cisco.nxos.loggingConfig.server","name":"cisco.nxos.loggingConfig.server","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Hostname, IPv4 address, or IPv6 address of the syslog server","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"facility":{"name":"facility","type":"\u0007","is_mandatory":true,"title":"Syslog facility used for messages sent to this server","desc":"For example `local7`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"UDP port used to reach the syslog server","desc":"Defaults to 514 when not explicitly configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for messages sent to this server","desc":"The lowest-priority level forwarded to this server. One of `emergencies` (0), `alerts` (1), `critical` (2), `errors` (3), `warnings` (4), `notifications` (5), `information` (6), or `debugging` (7).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF used to reach the syslog server","desc":"For example `default` or `management`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS remote syslog server","desc":"A single `logging server` destination from `show logging info`, keyed by server address and facility. Exposes where logs are sent and at what severity, so audits can confirm a device forwards to an approved collector.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.ntpConfiguration":{"id":"cisco.nxos.ntpConfiguration","name":"cisco.nxos.ntpConfiguration","fields":{"server":{"name":"server","type":"\u001bcisco.nxos.ntpConfiguration.server","title":"Cisco NX-OS NTP server","desc":"Single NTP time source parsed from `show running-config ntp`, with its preference flag, optional authentication key, poll-interval bounds, and the VRF used to reach it. A configured keyId indicates the association is authenticated.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001bcisco.nxos.ntpConfiguration.server","is_mandatory":true,"title":"Configured NTP servers","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceInterface":{"name":"sourceInterface","type":"\u001bcisco.nxos.interface","title":"Source interface used as the origin for NTP packets, resolved from sourceInterfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"sourceInterfaceName":{"name":"sourceInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the source interface used as the origin for NTP packets; empty when unset","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS NTP configuration","desc":"NTP client state parsed from `show running-config ntp`, listing the configured time servers and the source interface used for NTP packets. Auditing this confirms authenticated, redundant time sources are in place, for example `cisco.nxos.ntp.servers.length \u003e= 2`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.ntpConfiguration.server":{"id":"cisco.nxos.ntpConfiguration.server","name":"cisco.nxos.ntpConfiguration.server","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Hostname, IPv4 address, or IPv6 address of the NTP server","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyId":{"name":"keyId","type":"\u0005","is_mandatory":true,"title":"Authentication key ID used to authenticate this association; null when the association is unauthenticated","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"maxPoll":{"name":"maxPoll","type":"\u0005","is_mandatory":true,"title":"Maximum poll interval as a power-of-2 exponent (interval is 2^value seconds); falls back to 6 (64 seconds) when not set on the line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"minPoll":{"name":"minPoll","type":"\u0005","is_mandatory":true,"title":"Minimum poll interval as a power-of-2 exponent (interval is 2^value seconds); falls back to 6 (64 seconds) when not set on the line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"prefer":{"name":"prefer","type":"\u0004","is_mandatory":true,"title":"Whether this server is marked preferred (chosen over other reachable servers of equal quality)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"useVrf":{"name":"useVrf","type":"\u0007","is_mandatory":true,"title":"VRF used to reach this NTP server; empty when the default VRF is used","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS NTP server","desc":"Single NTP time source parsed from `show running-config ntp`, with its preference flag, optional authentication key, poll-interval bounds, and the VRF used to reach it. A configured keyId indicates the association is authenticated.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.passphraseLengthConfig":{"id":"cisco.nxos.passphraseLengthConfig","name":"cisco.nxos.passphraseLengthConfig","fields":{"maxLength":{"name":"maxLength","type":"\u0005","is_mandatory":true,"title":"Maximum permitted password length in characters","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"minLength":{"name":"minLength","type":"\u0005","is_mandatory":true,"title":"Minimum permitted password length in characters","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS password length policy","desc":"Global password (userpassphrase) length bounds parsed from `show running-config all | include userpassphrase`. Auditing these confirms a minimum length is enforced for locally configured user passwords.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.passphraseTimevalues":{"id":"cisco.nxos.passphraseTimevalues","name":"cisco.nxos.passphraseTimevalues","fields":{"graceTime":{"name":"graceTime","type":"\u0005","is_mandatory":true,"title":"Grace time after passphrase expiration","desc":"How long login is still permitted after the passphrase expires. Global default is 3 (days).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"graceTimeUnit":{"name":"graceTimeUnit","type":"\u0007","is_mandatory":true,"title":"Unit for the grace-time value","desc":"Normally `days`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lifeTime":{"name":"lifeTime","type":"\u0005","is_mandatory":true,"title":"Passphrase lifetime","desc":"How long a passphrase remains valid before it expires. Global default is 99999 (days), which effectively means no expiry.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"lifeTimeUnit":{"name":"lifeTimeUnit","type":"\u0007","is_mandatory":true,"title":"Unit for the lifetime value","desc":"Normally `days`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"Username these values apply to","desc":"Null when this record holds the global default aging values rather than a per-user override.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"warningTime":{"name":"warningTime","type":"\u0005","is_mandatory":true,"title":"Warning time before passphrase expiration","desc":"How far in advance the user is warned that the passphrase will expire. Global default is 14 (days).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"warningTimeUnit":{"name":"warningTimeUnit","type":"\u0007","is_mandatory":true,"title":"Unit for the warning-time value","desc":"Normally `days`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS passphrase aging time values","desc":"Password/passphrase aging thresholds, either the global defaults or the per-user values from the running-config. Exposes the warning, grace, and lifetime intervals so audits can verify password-expiry policy. The user field selects a specific user's values; it is null for the global defaults.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.role":{"id":"cisco.nxos.role","name":"cisco.nxos.role","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Role description text.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"rule":{"name":"rule","type":"\u001bcisco.nxos.role.rule","title":"Cisco NX-OS RBAC role rule","desc":"A single permit or deny rule within an RBAC role. Rules are applied in descending order by number. Depending on its type a rule grants read or read-write access (optionally scoped to a feature or feature group) or permits/denies a specific command string.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bcisco.nxos.role.rule","is_mandatory":true,"title":"Permission rules that make up the role.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS RBAC role","desc":"A role-based access control (RBAC) role from `show role`, including built-in roles like network-admin and network-operator and any user-defined roles. The rules list the permit/deny statements that grant or restrict access to features, feature groups, or specific commands. Useful for auditing privilege assignments, for example `cisco.nxos.roles.where(name == \"network-admin\")`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.role.rule":{"id":"cisco.nxos.role.rule","name":"cisco.nxos.role.rule","fields":{"accessType":{"name":"accessType","type":"\u0007","is_mandatory":true,"title":"Access the rule controls. One of `read`, `read-write`, or `command`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"entity":{"name":"entity","type":"\u0007","is_mandatory":true,"title":"Entity the rule applies to: the feature or feature-group name for a scoped rule, or the command string for a command rule. Empty when unscoped.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"number":{"name":"number","type":"\u0005","is_mandatory":true,"title":"Rule number. Rules are evaluated in descending numeric order.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"permission":{"name":"permission","type":"\u0007","is_mandatory":true,"title":"Whether the rule grants or blocks access. Either `permit` or `deny`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope of a read or read-write rule. Either `feature` or `feature-group`. Empty when the rule applies to all features or is a command rule.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS RBAC role rule","desc":"A single permit or deny rule within an RBAC role. Rules are applied in descending order by number. Depending on its type a rule grants read or read-write access (optionally scoped to a feature or feature group) or permits/denies a specific command string.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.routerEigrpEntry":{"id":"cisco.nxos.routerEigrpEntry","name":"cisco.nxos.routerEigrpEntry","fields":{"addressFamilies":{"name":"addressFamilies","type":"\u0019\u001bcisco.nxos.routerEigrpEntry.addressFamily","is_mandatory":true,"title":"Per-address-family configuration blocks for this EIGRP process, one per IPv4/IPv6 family and per VRF context","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"addressFamily":{"name":"addressFamily","type":"\u001bcisco.nxos.routerEigrpEntry.addressFamily","title":"EIGRP address-family configuration within a routing process","desc":"A single IPv4 or IPv6 address-family block of an EIGRP process, optionally scoped to a VRF. Exposes the security-relevant defaults for that family: whether interfaces are passive by default, whether MD5 neighbor authentication is in use, the authentication keychain, and adjacency-change logging. Use it to flag families that carry no MD5 authentication.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"as":{"name":"as","type":"\u0007","is_mandatory":true,"title":"EIGRP autonomous-system tag identifying the process (may be a number or a named string as it appears after `router eigrp`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"EIGRP routing process configured in the NX-OS running configuration","desc":"A `router eigrp` process parsed from `show running-config eigrp`, selected by its autonomous-system tag. Groups the per-address-family configuration (IPv4 and IPv6, including any under a VRF context) so you can audit passive-interface defaults, MD5 neighbor authentication, and adjacency-change logging across the process.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.routerEigrpEntry.addressFamily":{"id":"cisco.nxos.routerEigrpEntry.addressFamily","name":"cisco.nxos.routerEigrpEntry.addressFamily","fields":{"adjacencyChangeLoggingEnabled":{"name":"adjacencyChangeLoggingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether adjacency-change logging is enabled (true unless `no log-adjacency-changes` is present; logging is on by default)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authKeychain":{"name":"authKeychain","type":"\u0007","is_mandatory":true,"title":"Name of the keychain supplying the MD5 authentication keys, empty when authentication is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationMode":{"name":"md5AuthenticationMode","type":"\u0004","is_mandatory":true,"title":"Whether message digest 5 (MD5) neighbor authentication mode is configured for this address family","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passiveInterfaceDefaultEnabled":{"name":"passiveInterfaceDefaultEnabled","type":"\u0004","is_mandatory":true,"title":"Whether `passive-interface default` is set, making all interfaces passive (no EIGRP adjacencies formed) unless individually re-enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Address-family protocol, either ipv4 or ipv6","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"Name of the VRF this address family applies to, empty for the default VRF","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"EIGRP address-family configuration within a routing process","desc":"A single IPv4 or IPv6 address-family block of an EIGRP process, optionally scoped to a VRF. Exposes the security-relevant defaults for that family: whether interfaces are passive by default, whether MD5 neighbor authentication is in use, the authentication keychain, and adjacency-change logging. Use it to flag families that carry no MD5 authentication.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.routerOspfEntry":{"id":"cisco.nxos.routerOspfEntry","name":"cisco.nxos.routerOspfEntry","fields":{"as":{"name":"as","type":"\u0007","is_mandatory":true,"title":"OSPF process tag identifying the process (may be a number or a named string as it appears after `router ospf`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interfaces":{"name":"interfaces","type":"\u0019\u001bcisco.nxos.routerOspfEntry.ospfInterface","is_mandatory":true,"title":"Interfaces bound to this OSPF process, with their per-interface area, passive state, and authentication settings","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logAdjacencyChangesEnabled":{"name":"logAdjacencyChangesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether adjacency-change logging is enabled (`log-adjacency-changes`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logDetailedAdjacencyChangesEnabled":{"name":"logDetailedAdjacencyChangesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether verbose adjacency-change logging is enabled (`log-adjacency-changes detail`), recording every state transition rather than only up/down","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ospfInterface":{"name":"ospfInterface","type":"\u001bcisco.nxos.routerOspfEntry.ospfInterface","title":"OSPF interface configuration within a routing process","desc":"A single interface enrolled in an OSPF process, carrying its area assignment, passive state, and message-digest authentication settings. Use it to flag interfaces that participate in OSPF without MD5 authentication or that should be passive but are not.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"passiveInterfaceDefaultEnabled":{"name":"passiveInterfaceDefaultEnabled","type":"\u0004","is_mandatory":true,"title":"Whether `passive-interface default` is set, suppressing OSPF adjacencies on all interfaces unless individually re-enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"routerId":{"name":"routerId","type":"\u0007","is_mandatory":true,"title":"Router ID for this OSPF process, in IPv4 dotted-decimal form, empty when not explicitly set (then auto-selected from interface addresses)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"OSPF routing process configured in the NX-OS running configuration","desc":"A `router ospf` process parsed from `show running-config ospf`, selected by its process tag. Exposes the router ID, passive-interface default, adjacency-change logging, and the set of interfaces bound to the process so you can audit OSPF security posture across the device.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.routerOspfEntry.ospfInterface":{"id":"cisco.nxos.routerOspfEntry.ospfInterface","name":"cisco.nxos.routerOspfEntry.ospfInterface","fields":{"areaId":{"name":"areaId","type":"\u0007","is_mandatory":true,"title":"OSPF area this interface belongs to, as an area ID (a number or IPv4 dotted-decimal value)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authKeychain":{"name":"authKeychain","type":"\u0007","is_mandatory":true,"title":"Name of the keychain supplying the interface authentication keys, empty when not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interfaceName":{"name":"interfaceName","type":"\u0007","is_mandatory":true,"title":"Interface name as it appears in the configuration (e.g. Ethernet1/1)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"isPassive":{"name":"isPassive","type":"\u0004","is_mandatory":true,"title":"Whether the interface is passive (`ip ospf passive-interface`), advertising its subnet without forming adjacencies","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"md5AuthenticationEnabled":{"name":"md5AuthenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether message digest 5 (MD5) authentication is enabled on the interface (`ip ospf authentication message-digest`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ospfInterface":{"name":"ospfInterface","type":"\u001bcisco.nxos.interface","title":"Interface resource this OSPF configuration is attached to, resolved by interfaceName, null when no matching interface is found","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"OSPF interface configuration within a routing process","desc":"A single interface enrolled in an OSPF process, carrying its area assignment, passive state, and message-digest authentication settings. Use it to flag interfaces that participate in OSPF without MD5 authentication or that should be passive but are not.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.runAaaAuthenticationLoginEntry":{"id":"cisco.nxos.runAaaAuthenticationLoginEntry","name":"cisco.nxos.runAaaAuthenticationLoginEntry","fields":{"methodGroup":{"name":"methodGroup","type":"\u001bcisco.nxos.runAaaAuthenticationLoginEntry.methodGroup","title":"Method entry within an AAA authentication login list","desc":"A single method token from an NX-OS `aaa authentication login` method list, parsed from the space-separated method sequence that follows the list name. Each entry is one of three shapes: a named server group (`group tacacs+`), the local user database (`local` or `local-case`), or a built-in fallback method such as `enable`, `none`, `line`, or `krb5`. Use it to audit the ordered fallback chain, for example flagging lists whose last method is `none`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"methods":{"name":"methods","type":"\u0007","is_mandatory":true,"title":"Raw ordered method string, for example \"group tacacs+ local\".","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"methodsGroups":{"name":"methodsGroups","type":"\u0019\u001bcisco.nxos.runAaaAuthenticationLoginEntry.methodGroup","title":"Methods parsed into structured groups (local, server group, and so on).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Method list name, either \"default\" or a user-defined name.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS AAA authentication login method list","desc":"An AAA authentication login method list from `show running-config aaa | include \"authentication login\"`, either the \"default\" list or a named list. The methods define the ordered sequence of authentication sources (local, a server group, and so on) tried at login. Useful for verifying that login falls back to local authentication and does not rely on an unreachable server alone.","private":true,"defaults":"name methods","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.runAaaAuthenticationLoginEntry.methodGroup":{"id":"cisco.nxos.runAaaAuthenticationLoginEntry.methodGroup","name":"cisco.nxos.runAaaAuthenticationLoginEntry.methodGroup","fields":{"group":{"name":"group","type":"\u0004","is_mandatory":true,"title":"Whether this method references a named AAA server group (config keyword `group \u003cname\u003e`)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"local":{"name":"local","type":"\u0004","is_mandatory":true,"title":"Whether this method is the local user database (name is local or local-case)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Method token: a server-group name (e.g","desc":"tacacs+), a local database keyword (local or local-case), or a fallback method such as enable, none, line, or krb5","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Method entry within an AAA authentication login list","desc":"A single method token from an NX-OS `aaa authentication login` method list, parsed from the space-separated method sequence that follows the list name. Each entry is one of three shapes: a named server group (`group tacacs+`), the local user database (`local` or `local-case`), or a built-in fallback method such as `enable`, `none`, `line`, or `krb5`. Use it to audit the ordered fallback chain, for example flagging lists whose last method is `none`.","private":true,"defaults":"name local","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.runAaaGroupServerRadius":{"id":"cisco.nxos.runAaaGroupServerRadius","name":"cisco.nxos.runAaaGroupServerRadius","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server group name.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"servers":{"name":"servers","type":"\u0019\u0007","is_mandatory":true,"title":"Member RADIUS servers referenced by this group, in configured order.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS AAA RADIUS server group","desc":"A named AAA RADIUS server group and its member servers, from `show running-config radius | section \"aaa group server\"`. Server groups order which RADIUS servers AAA method lists use for authentication, authorization, and accounting.","private":true,"defaults":"name servers","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.runAaaGroupServerTacacs":{"id":"cisco.nxos.runAaaGroupServerTacacs","name":"cisco.nxos.runAaaGroupServerTacacs","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server group name.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"servers":{"name":"servers","type":"\u0019\u0007","is_mandatory":true,"title":"Member TACACS+ servers referenced by this group, in configured order.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS AAA TACACS+ server group","desc":"A named AAA TACACS+ server group and its member servers, from `show running-config tacacs+ | section \"aaa group server\"`. Server groups order which TACACS+ servers AAA method lists use for authentication, authorization, and accounting.","private":true,"defaults":"name servers","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.runInterfaceConfig":{"id":"cisco.nxos.runInterfaceConfig","name":"cisco.nxos.runInterfaceConfig","fields":{"dhcpSnoopingEnabled":{"name":"dhcpSnoopingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the interface is a DHCP snooping trusted port","desc":"True when `ip dhcp snooping trust` is configured, marking the port as trusted so DHCP snooping does not inspect or rate-limit DHCP messages arriving on it. Uplinks to legitimate DHCP servers are trusted; access ports facing hosts should not be.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interface":{"name":"interface","type":"\u001bcisco.nxos.interface","title":"Interface this running-config applies to","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"interfaceName":{"name":"interfaceName","type":"\u0007","is_mandatory":true,"title":"Interface name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipDirectedBroadcast":{"name":"ipDirectedBroadcast","type":"\u0004","is_mandatory":true,"title":"Whether IP directed broadcasts are enabled on this interface","desc":"True when `ip directed-broadcast` is configured. Directed broadcasts can be abused in amplification attacks (for example Smurf), so this is normally left disabled.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipRedirectsDisabled":{"name":"ipRedirectsDisabled","type":"\u0004","is_mandatory":true,"title":"Whether ICMP redirects are disabled on this interface","desc":"True when `no ip redirects` is configured, preventing the interface from sending ICMP redirect messages.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passiveInterfaceDisabledEigrpIds":{"name":"passiveInterfaceDisabledEigrpIds","type":"\u0019\u0007","is_mandatory":true,"title":"EIGRP process IDs for which this interface is explicitly not passive","desc":"The process tags from `no ip passive-interface eigrp \u003cid\u003e` lines, which override a global `passive-interface default` for these processes.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passiveInterfaceDisabledEigrpProcesses":{"name":"passiveInterfaceDisabledEigrpProcesses","type":"\u0019\u001bcisco.nxos.routerEigrpEntry","title":"EIGRP processes for which this interface is explicitly not passive","desc":"The EIGRP processes named in passiveInterfaceDisabledEigrpIds, resolved to their matching process resources.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passiveInterfaceEigrpIds":{"name":"passiveInterfaceEigrpIds","type":"\u0019\u0007","is_mandatory":true,"title":"EIGRP process IDs for which this interface is passive","desc":"The process tags from `ip passive-interface eigrp \u003cid\u003e` lines, where the interface neither sends nor receives EIGRP hellos.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passiveInterfaceEigrpProcesses":{"name":"passiveInterfaceEigrpProcesses","type":"\u0019\u001bcisco.nxos.routerEigrpEntry","title":"EIGRP processes for which this interface is passive","desc":"The EIGRP processes named in passiveInterfaceEigrpIds, resolved to their matching process resources.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"proxyArpEnabled":{"name":"proxyArpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether proxy ARP is enabled on this interface","desc":"True when `ip proxy-arp` is configured, letting the device answer ARP requests on behalf of hosts on other subnets.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"stormControlAction":{"name":"stormControlAction","type":"\u0007","is_mandatory":true,"title":"Storm control action taken when a traffic level is exceeded","desc":"From `storm-control action`, typically `shutdown` (err-disable the port) or `trap` (send an SNMP trap). Empty when no action is configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"stormControlBroadcastLevel":{"name":"stormControlBroadcastLevel","type":"\u0005","is_mandatory":true,"title":"Broadcast storm-control suppression level as a percentage of bandwidth","desc":"From `storm-control broadcast level`, expressed as a percentage of the interface's total bandwidth. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"stormControlBroadcastPps":{"name":"stormControlBroadcastPps","type":"\u0005","is_mandatory":true,"title":"Broadcast storm-control suppression level in packets per second","desc":"From `storm-control broadcast pps`. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"stormControlMulticastLevel":{"name":"stormControlMulticastLevel","type":"\u0005","is_mandatory":true,"title":"Multicast storm-control suppression level as a percentage of bandwidth","desc":"From `storm-control multicast level`, expressed as a percentage of the interface's total bandwidth. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"stormControlMulticastPps":{"name":"stormControlMulticastPps","type":"\u0005","is_mandatory":true,"title":"Multicast storm-control suppression level in packets per second","desc":"From `storm-control multicast pps`. Null when not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"urpfMode":{"name":"urpfMode","type":"\u0007","is_mandatory":true,"title":"Unicast RPF (uRPF) source-verification mode","desc":"From `ip verify unicast source reachable-via`. `rx` is strict mode (the packet must arrive on the interface used to reach its source), `any` is loose mode (the source must be reachable via any interface). Null when uRPF is not configured.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS interface running-config security settings","desc":"Security-relevant per-interface settings parsed from `show running-config interface`, keyed by interface name. Covers DHCP snooping trust, storm control, unicast RPF, IP redirects, directed broadcast, proxy ARP, and EIGRP passive-interface state. Select an interface with the `interfaceName` field, for example `cisco.nxos.runInterfaceConfig.where(interfaceName == \"Ethernet1/1\")`.","private":true,"defaults":"interfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.runRadiusServer":{"id":"cisco.nxos.runRadiusServer","name":"cisco.nxos.runRadiusServer","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"RADIUS server host, either an IPv4/IPv6 address or a hostname","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Shared secret used to authenticate to the RADIUS server, stored in the form indicated by keyType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyType":{"name":"keyType","type":"\u0005","is_mandatory":true,"title":"Encryption type of the shared key: 0 for cleartext, 6 for AES type-6 encryption, 7 for Cisco type-7 (weak, reversible) encryption","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"RADIUS server defined in the NX-OS running configuration","desc":"A `radius-server host` entry parsed from `show running-config radius`, exposing the server address and the shared secret used to authenticate the switch to the RADIUS AAA server. The address field selects the entry. Use it to audit that RADIUS keys are encrypted (keyType 7) rather than stored in cleartext (keyType 0).","private":true,"defaults":"address","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.runTacacsServer":{"id":"cisco.nxos.runTacacsServer","name":"cisco.nxos.runTacacsServer","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"TACACS+ server host, either an IPv4/IPv6 address or a hostname","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Shared secret used to authenticate to the TACACS+ server, stored in the form indicated by keyType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keyType":{"name":"keyType","type":"\u0005","is_mandatory":true,"title":"Encryption type of the shared key: 0 for cleartext, 6 for AES type-6 encryption, 7 for Cisco type-7 (weak, reversible) encryption","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"TACACS+ server defined in the NX-OS running configuration","desc":"A `tacacs-server host` entry parsed from `show running-config tacacs+`, exposing the server address and the shared secret used to authenticate the switch to the TACACS+ AAA server. The address field selects the entry. Use it to audit that TACACS+ keys are encrypted (keyType 7) rather than stored in cleartext (keyType 0).","private":true,"defaults":"address","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.scheduler":{"id":"cisco.nxos.scheduler","name":"cisco.nxos.scheduler","fields":{"job":{"name":"job","type":"\u001bcisco.nxos.scheduler.job","title":"Scheduler job on an NX-OS device","desc":"A named job consisting of an ordered list of CLI commands the scheduler executes as a batch when a schedule fires. Use it to review what a scheduled task actually does, for example a running-config backup to a remote server.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"jobs":{"name":"jobs","type":"\u0019\u001bcisco.nxos.scheduler.job","is_mandatory":true,"title":"Jobs defined on the device, each a named batch of CLI commands","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"logFileSizeKb":{"name":"logFileSizeKb","type":"\u0005","is_mandatory":true,"title":"Scheduler log-file size limit in kilobytes; range 16 to 1024, default 16","desc":"When a job produces more output than the log file can hold, the output is truncated.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"schedule":{"name":"schedule","type":"\u001bcisco.nxos.scheduler.schedule","title":"Scheduler schedule on an NX-OS device","desc":"A named schedule that runs one or more jobs at a defined time. The schedule may recur (daily, weekly, or monthly) or run once at a future start time. Use it to review when automated jobs execute and which jobs each schedule triggers.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"schedules":{"name":"schedules","type":"\u0019\u001bcisco.nxos.scheduler.schedule","is_mandatory":true,"title":"Schedules defined on the device, each binding jobs to a recurring or one-time run time","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"NX-OS command scheduler configuration","desc":"The device command scheduler, parsed from `show scheduler config`, which runs configured jobs (batches of CLI commands) at scheduled times. Exposes the log-file size limit plus the defined schedules and jobs. Use it to review automated maintenance tasks, for example confirming a configuration-backup job is scheduled.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.scheduler.job":{"id":"cisco.nxos.scheduler.job","name":"cisco.nxos.scheduler.job","fields":{"commands":{"name":"commands","type":"\u0019\u0007","is_mandatory":true,"title":"CLI commands the job executes, in configured order","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Job name","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Scheduler job on an NX-OS device","desc":"A named job consisting of an ordered list of CLI commands the scheduler executes as a batch when a schedule fires. Use it to review what a scheduled task actually does, for example a running-config backup to a remote server.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.scheduler.schedule":{"id":"cisco.nxos.scheduler.schedule","name":"cisco.nxos.scheduler.schedule","fields":{"assignedJobs":{"name":"assignedJobs","type":"\u0019\u001bcisco.nxos.scheduler.job","is_mandatory":true,"title":"Jobs bound to this schedule, in the order they run","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Schedule name","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"scheduleType":{"name":"scheduleType","type":"\u0007","is_mandatory":true,"title":"Recurrence type: daily","desc":"weekly, or monthly for a recurring schedule, or start for a one-time schedule that runs at a given start time (optionally with a repeat interval)","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"time":{"name":"time","type":"\u0007","is_mandatory":true,"title":"Configured run time, formatted according to scheduleType (e.g. daily HH:MM, weekly [dow:]HH:MM, or a start timestamp like YYYY:MM:DD:HH:MM)","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Scheduler schedule on an NX-OS device","desc":"A named schedule that runs one or more jobs at a defined time. The schedule may recur (daily, weekly, or monthly) or run once at a future start time. Use it to review when automated jobs execute and which jobs each schedule triggers.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.snmpConfiguration":{"id":"cisco.nxos.snmpConfiguration","name":"cisco.nxos.snmpConfiguration","fields":{"communities":{"name":"communities","type":"\u0019\u001bcisco.nxos.snmpConfiguration.community","is_mandatory":true,"title":"SNMPv1/v2c community strings and their associated group and ACL restrictions","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"community":{"name":"community","type":"\u001bcisco.nxos.snmpConfiguration.community","title":"Cisco NX-OS SNMP community","desc":"SNMPv1/v2c community string parsed from `show running-config snmp`, with its associated access group and any IPv4/IPv6 ACLs limiting which managers may use it. Communities are cleartext credentials, so unrestricted ones (no ACL) are a common finding.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"host":{"name":"host","type":"\u001bcisco.nxos.snmpConfiguration.host","title":"Cisco NX-OS SNMP notification host","desc":"SNMP notification receiver parsed from `show running-config snmp`. Each host defines where traps or informs are sent, the SNMP version and (for VRF-aware setups) the VRF used to reach and filter for the receiver, the source interface, and the destination UDP port.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"hosts":{"name":"hosts","type":"\u0019\u001bcisco.nxos.snmpConfiguration.host","is_mandatory":true,"title":"Configured SNMP notification host receivers","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"settings":{"name":"settings","type":"\u001bcisco.nxos.snmpConfiguration.settings","is_mandatory":true,"title":"Global SNMP settings, including SNMPv3 privacy enforcement and trap/inform source interfaces","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trap":{"name":"trap","type":"\u001bcisco.nxos.snmpConfiguration.trap","title":"Cisco NX-OS SNMP trap","desc":"Enablement state of a single SNMP trap type parsed from `show snmp trap`, which lists every notification the agent can emit grouped by feature. Auditing this confirms security-relevant traps (for example authentication failures or configuration changes) are enabled.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"traps":{"name":"traps","type":"\u0019\u001bcisco.nxos.snmpConfiguration.trap","title":"Per-event SNMP trap enablement, one entry per notification type","desc":"Enablement state of each named trap, parsed from `show snmp trap`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"user":{"name":"user","type":"\u001bcisco.nxos.snmpConfiguration.user","title":"Cisco NX-OS SNMP user","desc":"SNMPv3 user parsed from `show running-config snmp`. Each user carries one or more authentication and encryption settings that pair it with an SNMP group (role) and define its auth/privacy algorithms and keys. The `username` field is the selection key. Auditing users surfaces accounts that lack privacy (encryption) or use weak auth algorithms.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bcisco.nxos.snmpConfiguration.user","is_mandatory":true,"title":"SNMPv3 users and their authentication and encryption settings","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SNMP configuration","desc":"SNMP agent state parsed from `show running-config snmp`, covering global settings, SNMPv3 users and their authentication and privacy parameters, SNMPv1/v2c communities, notification host receivers, and the per-event trap enablement matrix. Auditing these detects weak or absent auth on SNMPv3, cleartext community strings, and unrestricted notification targets. For example `cisco.nxos.snmp.communities.where(ipv4Acl == \"\")` finds communities with no ACL restriction.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.snmpConfiguration.community":{"id":"cisco.nxos.snmpConfiguration.community","name":"cisco.nxos.snmpConfiguration.community","fields":{"group":{"name":"group","type":"\u001bcisco.nxos.role","title":"SNMP group (role) granting this community its access rights, resolved from groupName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"groupName":{"name":"groupName","type":"\u0007","is_mandatory":true,"title":"Name of the SNMP group (role) granting this community its access rights","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipv4Acl":{"name":"ipv4Acl","type":"\u0007","is_mandatory":true,"title":"Name of the IPv4 ACL restricting which managers may use this community; empty when unrestricted","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ipv6Acl":{"name":"ipv6Acl","type":"\u0007","is_mandatory":true,"title":"Name of the IPv6 ACL restricting which managers may use this community; empty when unrestricted","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Community string","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SNMP community","desc":"SNMPv1/v2c community string parsed from `show running-config snmp`, with its associated access group and any IPv4/IPv6 ACLs limiting which managers may use it. Communities are cleartext credentials, so unrestricted ones (no ACL) are a common finding.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.snmpConfiguration.host":{"id":"cisco.nxos.snmpConfiguration.host","name":"cisco.nxos.snmpConfiguration.host","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Hostname, IPv4 address, or IPv6 address of the SNMP notification receiver","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"filterVrf":{"name":"filterVrf","type":"\u0007","is_mandatory":true,"title":"VRF whose notifications are filtered toward this receiver; empty when no VRF filter is applied","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"notificationType":{"name":"notificationType","type":"\u0007","is_mandatory":true,"title":"Notification style delivered to this host, either `traps` or `informs`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"snmpVersion":{"name":"snmpVersion","type":"\u0007","is_mandatory":true,"title":"SNMP version used for notifications to this host, one of `1`, `2c`, or `3`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"srcInterface":{"name":"srcInterface","type":"\u001bcisco.nxos.interface","title":"Source interface used as the origin for notifications to this host, resolved from srcInterfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"srcInterfaceName":{"name":"srcInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the source interface used as the origin for notifications to this host; empty when unset","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"udpPort":{"name":"udpPort","type":"\u0005","is_mandatory":true,"title":"Destination UDP port for notifications to this host; null when the default (162) is used","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"useVrf":{"name":"useVrf","type":"\u0007","is_mandatory":true,"title":"VRF used to reach this notification receiver; empty when the default VRF is used","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SNMP notification host","desc":"SNMP notification receiver parsed from `show running-config snmp`. Each host defines where traps or informs are sent, the SNMP version and (for VRF-aware setups) the VRF used to reach and filter for the receiver, the source interface, and the destination UDP port.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.snmpConfiguration.settings":{"id":"cisco.nxos.snmpConfiguration.settings","name":"cisco.nxos.snmpConfiguration.settings","fields":{"encryptionEnforced":{"name":"encryptionEnforced","type":"\u0004","is_mandatory":true,"title":"Whether SNMPv3 privacy (encryption) is enforced globally for all users via `snmp-server globalEnforcePriv`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"informsSrcInterface":{"name":"informsSrcInterface","type":"\u001bcisco.nxos.interface","title":"Source interface used as the origin for outgoing SNMP inform notifications, resolved from informsSrcInterfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"informsSrcInterfaceName":{"name":"informsSrcInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the source interface used as the origin for outgoing SNMP inform notifications; empty when unset","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapsSrcInterface":{"name":"trapsSrcInterface","type":"\u001bcisco.nxos.interface","title":"Source interface used as the origin for outgoing SNMP trap notifications, resolved from trapsSrcInterfaceName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"trapsSrcInterfaceName":{"name":"trapsSrcInterfaceName","type":"\u0007","is_mandatory":true,"title":"Name of the source interface used as the origin for outgoing SNMP trap notifications; empty when unset","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SNMP global settings","desc":"Device-wide SNMP settings parsed from `show running-config snmp`, independent of any individual user, community, or host. Covers whether SNMPv3 privacy is enforced for all users and which source interfaces notifications and informs originate from. When no SNMP config is present these default to privacy off and empty source interfaces.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.snmpConfiguration.trap":{"id":"cisco.nxos.snmpConfiguration.trap","name":"cisco.nxos.snmpConfiguration.trap","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the trap event","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether this trap type is enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Trap type identifier, typically `feature: event` as reported by the device","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SNMP trap","desc":"Enablement state of a single SNMP trap type parsed from `show snmp trap`, which lists every notification the agent can emit grouped by feature. Auditing this confirms security-relevant traps (for example authentication failures or configuration changes) are enabled.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.snmpConfiguration.user":{"id":"cisco.nxos.snmpConfiguration.user","name":"cisco.nxos.snmpConfiguration.user","fields":{"authSettings":{"name":"authSettings","type":"\u0019\u001bcisco.nxos.snmpConfiguration.user.authenticationSettings","is_mandatory":true,"title":"Authentication and encryption settings binding this user to a group with its auth and privacy algorithms and keys","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authenticationSettings":{"name":"authenticationSettings","type":"\u001bcisco.nxos.snmpConfiguration.user.authenticationSettings","title":"Cisco NX-OS SNMP user authentication and encryption settings","desc":"Authentication and privacy parameters for one SNMPv3 user-to-group binding, parsed from a `snmp-server user` line. Fields carry the auth and privacy algorithms, the (usually localized/encrypted) key material, the SNMP engine ID scoping the keys, and the stored key format. Most fields are empty when not present on the line.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"encryptionEnforced":{"name":"encryptionEnforced","type":"\u0004","is_mandatory":true,"title":"Whether SNMPv3 privacy (message encryption) is enforced for this user via the `enforcePriv` keyword","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"SNMP username","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SNMP user","desc":"SNMPv3 user parsed from `show running-config snmp`. Each user carries one or more authentication and encryption settings that pair it with an SNMP group (role) and define its auth/privacy algorithms and keys. The `username` field is the selection key. Auditing users surfaces accounts that lack privacy (encryption) or use weak auth algorithms.","private":true,"defaults":"username","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.snmpConfiguration.user.authenticationSettings":{"id":"cisco.nxos.snmpConfiguration.user.authenticationSettings","name":"cisco.nxos.snmpConfiguration.user.authenticationSettings","fields":{"authAlgorithm":{"name":"authAlgorithm","type":"\u0007","is_mandatory":true,"title":"Authentication algorithm, typically `md5`, `sha`, or `sha-256`; empty when auth is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"authPassword":{"name":"authPassword","type":"\u0007","is_mandatory":true,"title":"Authentication key (stored in localized/encrypted form); empty when auth is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionAlgorithm":{"name":"encryptionAlgorithm","type":"\u0007","is_mandatory":true,"title":"Privacy (encryption) algorithm, typically `des`, `3des`, `aes-128`, `aes-192`, or `aes-256`; empty when privacy is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionPassword":{"name":"encryptionPassword","type":"\u0007","is_mandatory":true,"title":"Privacy (encryption) key (stored in localized/encrypted form); empty when privacy is not configured","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"engineId":{"name":"engineId","type":"\u0007","is_mandatory":true,"title":"SNMP engine ID the keys are localized to; empty when not scoped to a remote engine","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"group":{"name":"group","type":"\u001bcisco.nxos.role","title":"SNMP group (role) this user is assigned to, resolved from groupName","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"groupName":{"name":"groupName","type":"\u0007","is_mandatory":true,"title":"Name of the SNMP group (role) this user is assigned to; empty when not specified on the line","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordEncType":{"name":"passwordEncType","type":"\u0005","is_mandatory":true,"title":"Numeric encryption-type indicator preceding the stored key on the config line; null when absent","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passwordFormat":{"name":"passwordFormat","type":"\u0007","is_mandatory":true,"title":"Key storage format, either `localizedkey` or `localizedV2key`","desc":"`localizedkey` stores keys in localized form; `localizedV2key` stores them in the newer encrypted form. Empty when the keys are supplied in cleartext rather than a stored format.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SNMP user authentication and encryption settings","desc":"Authentication and privacy parameters for one SNMPv3 user-to-group binding, parsed from a `snmp-server user` line. Fields carry the auth and privacy algorithms, the (usually localized/encrypted) key material, the SNMP engine ID scoping the keys, and the stored key format. Most fields are empty when not present on the line.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.sshConfig":{"id":"cisco.nxos.sshConfig","name":"cisco.nxos.sshConfig","fields":{"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"SSH host key algorithm","desc":"One of `rsa`, `dsa`, or `ecdsa`. DSA is fixed at 1024 bits and is considered legacy; RSA and ECDSA are the recommended algorithms.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"keySize":{"name":"keySize","type":"\u0005","is_mandatory":true,"title":"SSH host key size in bits","desc":"The modulus/key length, for example 2048 or 4096 for RSA. Null for DSA, which has no configurable size (it is fixed at 1024 bits).","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS SSH host key configuration","desc":"SSH host key parameters from the running-config `ssh key` line: the key algorithm and, where applicable, the modulus size. Lets audits flag weak or undersized SSH host keys (for example RSA below 2048 bits or the legacy DSA algorithm).","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.switchportConfig":{"id":"cisco.nxos.switchportConfig","name":"cisco.nxos.switchportConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the port is operating as a Layer-2 switchport.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"monitorEnabled":{"name":"monitorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the port is configured as a switchport monitor (SPAN) destination.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"operationalMode":{"name":"operationalMode","type":"\u0007","is_mandatory":true,"title":"Operational switchport mode, for example \"access\" or \"trunk\".","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS switchport configuration","desc":"Layer-2 switchport settings for an interface, from `show interface switchport`. Reports whether the port operates as a switchport, whether it is a monitor (SPAN) port, and its operational mode (access, trunk, or similar).","private":true,"defaults":"enabled","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.systemLoginConfiguration":{"id":"cisco.nxos.systemLoginConfiguration","name":"cisco.nxos.systemLoginConfiguration","fields":{"attempts":{"name":"attempts","type":"\u0005","is_mandatory":true,"title":"Number of failed login attempts within the window that triggers the quiet period","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"blockFor":{"name":"blockFor","type":"\u0005","is_mandatory":true,"title":"Quiet-period length in seconds during which logins are blocked once the failed-attempt threshold is hit","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"within":{"name":"within","type":"\u0005","is_mandatory":true,"title":"Length in seconds of the sliding window over which failed login attempts are counted","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS login lockout configuration","desc":"Automatic login-blocking policy set with `system login block-for` (the `login block-for` command on releases before NX-OS 7.0(3)I6(1)), parsed from `show running-config | include \"system login\"`. When the number of failed authentications reaches `attempts` inside the `within` window, the device enters a quiet period of `blockFor` seconds during which all Telnet and SSH logins are denied. The feature is disabled by default, so all three fields are null when it is not configured. Use it to confirm brute-force protection is present, for example `cisco.nxos.systemLogin.where(blockFor \u003e 0)`.","private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.user":{"id":"cisco.nxos.user","name":"cisco.nxos.user","fields":{"credential":{"name":"credential","type":"\u001bcisco.nxos.user.credential","title":"Cisco NX-OS user credential","desc":"A single credential attached to a local user account: either a password hash or an SSH public key. Fields expose the credential kind, the encryption type of a stored password, the credential value itself, and any role and expiration date associated with it.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"creds":{"name":"creds","type":"\u0019\u001bcisco.nxos.user.credential","is_mandatory":true,"title":"Credentials configured for the account (passwords and SSH keys).","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"isAdmin":{"name":"isAdmin","type":"\u0004","title":"Whether this is the built-in \"admin\" account.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"passphraseTimeSettings":{"name":"passphraseTimeSettings","type":"\u001bcisco.nxos.passphraseTimevalues","title":"Passphrase aging settings for the account, either its explicit configuration or the global defaults.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Account name.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS local user account","desc":"A locally defined user account parsed from `show running-config | include username`, with its stored credentials (password hashes and SSH keys), assigned role, and passphrase aging settings. Useful for auditing local accounts, credential encryption, and role assignments, for example `cisco.nxos.users.where(username != \"admin\")`.","private":true,"defaults":"username","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"cisco.nxos.user.credential":{"id":"cisco.nxos.user.credential","name":"cisco.nxos.user.credential","fields":{"credential":{"name":"credential","type":"\u0007","is_mandatory":true,"title":"Credential value: the password hash for a password credential, or the SSH public key for an sshkey credential.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"credentialType":{"name":"credentialType","type":"\u0007","is_mandatory":true,"title":"Kind of credential. One of `password`, `sshkey`, or `unknown`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Password encryption type code as configured, for a password credential. `0` is clear text and `5` is an MD5-crypt hash. Empty for SSH keys.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"expireDate":{"name":"expireDate","type":"\t","is_mandatory":true,"title":"Explicit expiration date of the credential, from a `expire` keyword. Null when the credential does not expire.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role granted through this credential line, when the credential is defined together with a `role` keyword.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"Cisco NX-OS user credential","desc":"A single credential attached to a local user account: either a password hash or an SSH public key. Fields expose the credential kind, the encryption type of a stored password, the credential value itself, and any role and expiration date associated with it.","private":true,"defaults":"credentialType","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"networkdevices":{"id":"networkdevices","fields":{"command":{"name":"command","type":"\u001bnetworkdevices.command","title":"Command executed on a network device","desc":"Arbitrary command run against the connected network device, returning the device's raw text output. Select the command with the `command` argument, for example `networkdevices.command(command: \"show running-config\")`, and read `result` for the unparsed output. Each distinct command string is a separate instance, so a given command runs (and is cached) only once per scan. This is the low-level building block behind the parsed Cisco resources, useful for auditing command output that no dedicated resource yet exposes.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"networkdevices.command":{"id":"networkdevices.command","name":"networkdevices.command","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command string sent to the device, for example `show version`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"result":{"name":"result","type":"\u0007","refs":["\"command\""],"title":"Raw text output returned by the device for the command, exactly as printed with no parsing applied","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"init":{"args":[{"name":"command","type":"\u0007"}]},"title":"Command executed on a network device","desc":"Arbitrary command run against the connected network device, returning the device's raw text output. Select the command with the `command` argument, for example `networkdevices.command(command: \"show running-config\")`, and read `result` for the unparsed output. Each distinct command string is a separate instance, so a given command runs (and is cached) only once per scan. This is the low-level building block behind the parsed Cisco resources, useful for auditing command output that no dedicated resource yet exposes.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ntc":{"id":"ntc","fields":{"template":{"name":"template","type":"\u001bntc.template","title":"Network to Code TextFSM template","desc":"Single Network to Code (ntc-templates) parsing template that maps one device platform and `show` command to its TextFSM definition. Select a template by that pair, for example `ntc.template(platform: \"cisco_ios\", command: \"show version\")`, or by its `id`. The `template` field returns the raw TextFSM template text.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true},"templates":{"name":"templates","type":"\u001bntc.templates","title":"Bundled Network to Code TextFSM template collection","desc":"Full set of Network to Code (ntc-templates) parsing templates shipped with the provider, one `ntc.template` per entry. Each template maps a device platform and `show` command to the TextFSM definition used to turn that command's output into structured data, so this list shows which platform and command combinations the provider can parse out of the box.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"ntc.template":{"id":"ntc.template","name":"ntc.template","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"The `show` command whose output the template parses, for example `show version`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Template identifier, the template file base name without the `.textfsm` suffix, for example `cisco_ios_show_version`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"platform":{"name":"platform","type":"\u0007","is_mandatory":true,"title":"Device platform the template parses, using the ntc-templates platform name, for example `cisco_ios`, `cisco_nxos`, or `cisco_xr`","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"template":{"name":"template","type":"\u0007","title":"Raw TextFSM template text for this platform and command","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"init":{"args":[{"name":"platform","type":"\u0007"},{"name":"command","type":"\u0007"}]},"title":"Network to Code TextFSM template","desc":"Single Network to Code (ntc-templates) parsing template that maps one device platform and `show` command to its TextFSM definition. Select a template by that pair, for example `ntc.template(platform: \"cisco_ios\", command: \"show version\")`, or by its `id`. The `template` field returns the raw TextFSM template text.","defaults":"platform command","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"ntc.templates":{"id":"ntc.templates","name":"ntc.templates","fields":{"list":{"name":"list","type":"\u0019\u001bntc.template","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"list_type":"\u001bntc.template","title":"Bundled Network to Code TextFSM template collection","desc":"Full set of Network to Code (ntc-templates) parsing templates shipped with the provider, one `ntc.template` per entry. Each template maps a device platform and `show` command to the TextFSM definition used to turn that command's output into structured data, so this list shows which platform and command combinations the provider can parse out of the box.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"parse":{"id":"parse","fields":{"textfsm":{"name":"textfsm","type":"\u001bparse.textfsm","title":"TextFSM template parser","desc":"Structured records extracted from raw device output by applying a TextFSM template. TextFSM is a template-driven state machine that turns semi-structured CLI text into rows of named values. Set `template` to the template definition and `content` to the text to parse, then read `params` for one dict per matched row keyed by the template's value names. This is the parsing engine behind the structured Cisco resources, and can parse any command output for which you supply a template.","provider":"go.mondoo.com/cnquery/providers/networkdevices","is_implicit_resource":true}},"is_extension":true},"parse.textfsm":{"id":"parse.textfsm","name":"parse.textfsm","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Raw text to parse, typically the output of a `show` command","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"params":{"name":"params","type":"\u0019\n","title":"Parsed records","desc":"One dict per row the template records, each keyed by the template's `Value` names. Empty when the template matches nothing in `content`.","provider":"go.mondoo.com/cnquery/providers/networkdevices"},"template":{"name":"template","type":"\u0007","is_mandatory":true,"title":"TextFSM template text: the `Value` definitions (named capture regexes) and the state rules that decide when a row of `content` is recorded","provider":"go.mondoo.com/cnquery/providers/networkdevices"}},"title":"TextFSM template parser","desc":"Structured records extracted from raw device output by applying a TextFSM template. TextFSM is a template-driven state machine that turns semi-structured CLI text into rows of named values. Set `template` to the template definition and `content` to the text to parse, then read `params` for one dict per matched row keyed by the template's value names. This is the parsing engine behind the structured Cisco resources, and can parse any command output for which you supply a template.","provider":"go.mondoo.com/cnquery/providers/networkdevices"}}}