Overview

iboss Inspector (Beta)

iboss Zero Trust SSE is a cloud-native Secure Service Edge platform that decides what a workforce can reach on the internet — web filtering, HTTPS decryption, DLP, firewall rules, and Zero Trust Network Access (ZTNA) to private applications, all enforced from one cloud inspection path rather than a stack of on-prem appliances. The iboss Inspector (Beta) connects to a single iboss account and snapshots its entire security configuration daily — cluster topology, every policy layer and its allow/block entries, policy and reporting groups, proxy users and devices, locations, private networks, SSL decryption posture, DLP rules, firewall rules, ZTNA peers, and licensed modules — so an MSP can see what changed without logging into the iboss Admin Console.

What you can monitor

• Cluster and node topology, and whether a reporting cluster is provisioned
• Security policy layers, including any that have been disabled
• Allowlist and blocklist entries, by policy layer
• Default policy groups and reporting groups
• Statically defined proxy users and devices, including devices left in the default policy group
• Locations (PAC zones) and private networks
• SSL decryption posture and applications excluded from HTTPS inspection
• DLP content-analysis rules
• Firewall rules and ZTNA routed peers
• Licensed module entitlements
• Days remaining until the iboss API key expires

How it works

A single launchpoint authenticates to one iboss account using an API key. Because an iboss API key can only ever see the account it was created in, this is a single-launchpoint inspector — there is no parent/child discovery step. On each run, the inspector automatically discovers that account's gateway and reporting cluster hostnames before reading its configuration; no node hostname is ever entered manually.

Benefits

• Catch a security policy that was disabled during troubleshooting and never re-enabled.
• See an allowlist that's quietly grown past what anyone intended to bypass.
• Find devices stuck in the default policy group running the weakest ruleset.
• Confirm DLP and other licensed modules are actually configured, not just contracted.
• Get alerted 30 days before the iboss API key expires — before it silently breaks every iboss integration you run.

Inspector Setup Preparation

Inspector Setup:

Step 1: Create the API Key in iboss

1. Sign in to the iboss Admin Console as an administrator of the account to be monitored, and note the hostname in the browser address bar — if it isn't the standard cloud, that hostname is what you'll enter as the Cloud API Domain in Liongard.
2. Under account user management, create a dedicated API user for Liongard rather than reusing a person's account.
3. Generate that user's API key and copy it. Note the expiry date the console shows — iboss keys expire on a server-set schedule, with no warning and no refresh.

Step 2: Configure the iboss Inspector in Liongard

In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the iboss Inspector > Select Add System.

Fill in the following information:

• Environment: Select the Environment this iboss account should be associated to
• Friendly Name: Suggested: "iboss [Customer Name]"
• Agent: Select the appropriate Agent
• Inspector Version: Latest
• API Key: The API key generated in Step 1
• Cloud API Domain: Leave at api.ibosscloud.com unless Step 1 showed a different hostname — this field exists only for dedicated, sovereign, and government iboss clouds
• Account Settings ID: Leave blank. The account is discovered from the API key, which can only ever see one.
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule

Select Save. The Inspector will now be triggered to run within the minute. The first run performs a discovery handshake and logs the gateway and reporting hostnames it resolved — the fastest way to confirm everything is wired correctly.

Repeat this setup once per iboss account. An MSP with forty iboss customers ends up with forty launchpoints, each with its own key — this is a property of the iboss API key, which can only ever see the single account it was created in.

Flexible Asset/Configuration Auto-Updating

This inspector does not yet contribute to Flexible Assets/Configurations — no ConnectWise or IT Glue asset mappings ship with it today, so turning on those auto-updating toggles will not produce any data for this inspector.

Troubleshooting

• Every call 401s and the run fails immediately: The API key has expired or been revoked, or the Cloud API Domain points at the wrong iboss cloud. There's no refresh path for an API key — a 401 is terminal by design. Confirm the key is valid in the Admin Console and that the domain matches your console's hostname; regenerate the key if it's lapsed and update the launchpoint.
• Policies, Users & Devices, and SSL Decryption are all empty: No secure web gateway cluster was discovered, so the entire gateway tier was skipped. Check the Overview view for a blank discovered gateway hostname, and confirm with iboss that the account has a provisioned gateway cluster.
• Cloud Preferences shows data but no report log archives appear: The account has no reporting cluster, so the reporter tier was skipped — the "No reporting cluster provisioned" rule will have fired. Confirm with iboss that a reporting cluster is licensed for the account.
• DLP and Firewall & ZTNA tabs are empty on an account that should have them: Those endpoints returned a not-licensed response. Check the Modules Not Licensed field on the Overview view against the customer's contract — if the module is contracted, that's a conversation with iboss, not a Liongard issue.
• Allow/block entry counts look lower than the iboss console shows: The account has more than 50 allow/block policy layers and the fan-out was capped. The Overview view will show Allow/Block List Truncated as true.
• Accounts Visible To Credential reads more than 1: Let Liongard Support know — this indicates the account model has changed and is the trigger condition for future parent/child support.

Inspector FAQs