Linking Automox as a source
This source is currently in alpha. The interface and available tables may change.
The Automox connector syncs your patch management and endpoint data into the PostHog Data warehouse, so you can trend remediation coverage and device compliance alongside your product data.
Automox is a cloud-native patch management and endpoint management platform used by IT and security teams to automate patching, manage device inventory, and enforce compliance policies across their fleet.
Prerequisites
You need:
- An Automox account with access to Settings → API Keys in the Automox console.
- An API key created there (used as a bearer token). API keys are user-scoped, so requests are attributed to the user who created the key.
- If your API key has access to more than one organization, the numeric organization ID to sync. Find this under Settings → Organization in the Automox console.
Adding a data source
- In PostHog, go to the Sources tab of the data pipeline section.
- Click + New source and click Link next to this source.
- Enter your credentials (see Configuration below) and click Next.
- Select the tables you want to sync, choose a sync method and frequency, then click Import.
Once the syncs are complete, you can start querying this data in PostHog.
When linking Automox, you'll need:
API key – create one under Settings → API Keys in the Automox console. Copy the key and paste it into PostHog.
Organization ID (optional) – if your API key can access more than one organization, enter the numeric organization ID the source should sync. Leave it blank when the key only belongs to one organization.
Sync modes
Each table can be synced in one of several modes, depending on what the source supports:
- Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
- Incremental – only new or updated rows are synced on each run, using a cursor field (such as an
updated_attimestamp). Cheaper than a full refresh, but deletes aren't captured. - Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
- Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.
See sync methods for a full explanation of how each mode works and how to choose between them.
The policy_runs table (policy execution history) and events table (console activity log) support incremental sync using Automox's server-side time filters, so they only fetch new rows on each run. All other tables (devices, organizations, packages, policies, server_groups, users) sync as full refresh because the Automox API doesn't expose an "updated since" filter for those endpoints.
Configuration
| Option | Type | Required |
|---|---|---|
API key | password | Yes |
Organization ID (optional) | text | No |
Supported tables
| Table | Description | Sync method | Incremental field | Primary key |
|---|---|---|---|---|
devices | A device (server, workstation, or endpoint) managed by the Automox agent, with OS details, connection state, and patch/compliance status. | Full refresh | — | id |
events | An entry from the Automox console activity log, such as patches applied or failed, devices added or deleted, and policy actions. | Incremental, Full refresh | create_time | id |
organizations | An Automox organization (zone) the API key can access, with device counts and limits. | Full refresh | — | id |
packages | A software package on a managed device, including installation state, patch severity, and associated CVEs. One row per package per device. | Full refresh | — | id, server_id |
policies | An Automox policy (patch, required software, or custom worklet) with its schedule and configuration. | Full refresh | — | id |
policy_runs | A policy execution from the Automox Policy History API, with per-status device counts for the run. | Incremental, Full refresh | run_time | policy_uuid, execution_token |
server_groups | A server group used to organize devices and target policies. | Full refresh | — | id |
users | A user with access to the Automox organization. | Full refresh | — | id |
Troubleshooting
"Automox authentication failed" – the API key is wrong or has expired. Create a new key under Settings → API Keys in the Automox console and re-enter it in PostHog.
"Automox API key has access to multiple organizations" – the key can access several organizations, so PostHog can't pick one automatically. Enter the numeric organization ID on the source configuration.
"Automox organization not found" – the configured organization ID doesn't match any organization the key can access. Check the ID under Settings → Organization in the Automox console.
If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.