Invariant Documentation

website·Indexed 31 days ago

https://docs.invariant.tech

Documentation for Invariant, a network analysis tool that supports all platforms supported by Batfish. It includes guides on identity and access management using OIDC, REST API usage, CLI installation via pip, and the creation of network snapshots. The platform provides detailed analysis of access policies, critical flows, and network properties such as HSRP, MLAG, and interface settings.

Tokens: 51.5K
Snippets: 210
Records: 335
Agent score: 53%

What's inside Invariant

Understand Monitor Target API response schemas

The API for retrieving monitor targets returns a list of MonitorTarget objects. Each object contains identification, organizational context, activity status, and specific metadata about the target being monitored.

// Successful Response (200 OK)
[
  {
    "uuid": "string (uuid)",
    "organization_uuid": "string (uuid)",
    "is_active": "boolean",
    "created_at": "string (date-time)",
    "metadata": {
      "name": "string",
      "comment": "string | null",
      "repository_url": "string | null",
      "monitor_path": "string | null",
      "network_name": "string | null"
    }
  }
]

Manage network snapshots using Invariant Networks
An Invariant Network is a construct used to organize a time-series of network snapshots. It acts as a container for uploads, reports, and policies, allowing users to validate networks against security policies, monitor for breakages, and track network health over time.
https://docs.invariant.tech/llms-full.txt?llms-doc=understanding-the-user-invitation-processwebsitellms

Reference VRRP group properties in vrrp_properties

The vrrp_properties dataset provides detailed information about Virtual Router Redundancy Protocol (VRRP) groups configured on the network. It includes mapping of interfaces to their VRRP group IDs, virtual addresses, and operational status.

Field Definitions

Field	Type	Description
`Interface`	`Interface`	The network interface associated with the VRRP group.
`Group_Id`	`Integer`	The VRRP Group ID.
`Virtual_Addresses`	`List of IPs`	The virtual IP addresses assigned to the group.
`Source_Address`	`String`	The source address used for sending VRRP messages.
`Priority`	`Integer`	The priority of the VRRP router (used to determine the master).
`Preempt`	`Boolean`	Indicates whether preemption is enabled.
`Active`	`Boolean`	Indicates whether the interface is currently active.

Understand the parse_warnings data structure
The parse_warnings object provides details about issues encountered during the parsing process, such as failure to recognize specific lines or a lack of support for certain features. It contains the following fields:
- Filename (String): The name of the file being parsed.
- Line (Integer): The specific line number in the input file that triggered the warning.
- Text (String): The actual text from the input that caused the warning.
- Parser_Context (String): The state or context of the Batfish parser at the time the warning occurred.
- Comment (String): An optional additional explanation providing more detail about the warning.
https://docs.invariant.tech/llms-full.txt?llms-doc=parse-warningswebsitellms
Reference HSRP group properties in hsrp_properties
The hsrp_properties dataset provides information about HSRP Groups within the network. It contains the following fields:
- Interface (Interface): The network interface associated with the HSRP group.
- Group_Id (Integer): The HSRP Group ID.
- Virtual_Addresses (List of IPs): The virtual IP addresses assigned to the group.
- Source_Address (String): The source address used for sending HSRP messages.
- Priority (Integer): The priority of the HSRP router (used to determine the active router).
- Preempt (Boolean): Indicates whether preemption is enabled, allowing a higher-priority router to take over the active role.
- Active (Boolean): Indicates whether the interface is currently the active router for the group.
https://docs.invariant.tech/llms-full.txt?llms-doc=hsrp-propertieswebsitellms

Understand the mlag_properties data structure

The mlag_properties table provides information about each Multi-Chassis Link Aggregation (MLAG) domain within the network. It maps nodes to their respective MLAG domain IDs and peering configurations.

Field	Type	Description
`Node`	`Node`	Node name.
`MLAG_ID`	`String`	MLAG domain ID.
`Peer_Address`	`IP`	Peer's IP address.
`Local_Interface`	`Interface`	Local interface used for MLAG peering.
`Source_Interface`	`Interface`	Local interface used as source-interface for MLAG peering.

Understand the policy_skipped error object

The policy_skipped object is returned when Invariant encounters invalid access control rules that cannot be evaluated because they require correction. This object provides details about the specific rule that failed and the associated errors.

{
  "index": 0,            // Integer: Index of the policy test
  "ok": false,           // Boolean: Always false for skipped rules
  "skipped": true,       // Boolean: Always true for skipped rules
  "policy": { ... },     // JSON: The policy part of the rule definition
  "rule": { ... },       // JSON: The rule part of the rule definition
  "errors": ["..."],    // List of Strings: Errors generated from this test
  "rule_type": "...",   // String: ingress-deny, egress-deny, ingress-deny-others, or egress-deny-others
  "violations": 0,       // Integer: Always zero
  "checks": 0,           // Integer: Always zero
  "enforce": true        // Boolean: Indicates if this rule is enforced
}

Understand user identity types in Invariant
Invariant distinguishes between two primary types of user identities based on their email domain:
- Managed Users (Domain Users): Users with email addresses belonging to a domain owned or managed by the Invariant workspace (e.g., user@yourcompany.invariant.tech). These users have lifecycles and behaviors that can be controlled via workspace settings.
- External Collaborators: Users from outside the managed domain (e.g., consultant@externaldomain.com) who are invited into the workspace to collaborate.
https://docs.invariant.tech/llms-full.txt?llms-doc=overview-identity-and-access-in-invariantwebsitellms

Understand the ospf_session_compatibility data schema

The ospf_session_compatibility output provides details about OSPF sessions in the network. It includes local and remote interface details, VRF assignments, IP addresses, OSPF areas, and the overall session status.

Field	Type	Description
`Interface`	`Interface`	Interface.
`VRF`	`String`	VRF.
`IP`	`IP`	Ip.
`Area`	`Long`	Area.
`Remote_Interface`	`Interface`	Remote Interface.
`Remote_VRF`	`String`	Remote VRF.
`Remote_IP`	`IP`	Remote IP.
`Remote_Area`	`Long`	Remote Area.
`Session_Status`	`String`	Status of the OSPF session.

Understand the policy_ok object structure for access control rules

The policy_ok object is used to represent a test that has successfully passed access control rules. It contains metadata about the rule definition, the type of rule being evaluated, and the results of the check.

{
  "index": 0,             // Integer: Index of the policy test
  "ok": true,            // Boolean: Always true for this object
  "skipped": false,       // Boolean: Always false for this object
  "policy": { ... },     // JSON: The policy part of the rule definition
  "rule": { ... },       // JSON: The rule part of the rule definition
  "errors": [],           // List of Strings: Errors generated from this test
  "rule_type": "string", // String: One of 'ingress-deny', 'egress-deny', 'ingress-deny-others', or 'egress-deny-others'
  "violations": 0,        // Integer: Always zero
  "checks": 10,           // Integer: Total number of checks performed during evaluation
  "enforce": true         // Boolean: Indicates if this rule is enforced
}

Understand the Identity and Access framework in Invariant
Access management in Invariant is divided into three core pillars:
1. Identity: The unique digital identity of a user, typically associated with an email address, used to distinguish individuals.
2. Authentication: The process of validating a user's credentials to prove they are who they claim to be before granting access.
3. Authorization (Access Control): The process of determining which specific resources, features, or data an authenticated user can access and what actions they can perform (typically managed via roles and permissions).
https://docs.invariant.tech/llms-full.txt?llms-doc=overview-identity-and-access-in-invariantwebsitellms
Understand the role of OIDC in Invariant authentication
Invariant Technology uses OpenID Connect (OIDC), a protocol built on OAuth 2.0, to integrate with Identity Providers (IdPs) such as Okta, Azure AD, and Auth0. This enables Single Sign-On (SSO), allowing users to use corporate credentials for access. Key benefits include centralized identity management (consistent password policies and MFA), simplified onboarding/offboarding (disabling an account in the IdP revokes access to Invariant), and enhanced security by removing the need for Invariant to store user passwords.
https://docs.invariant.tech/llms-full.txt?llms-doc=the-role-of-oidc-in-user-authenticationwebsitellms