---
description: >-
  Secure datasource discovery using an Insight Point running in your own
  environment.
---

# Insight Point

#### What is a Veza Insight Point?

An Insight Point is a lightweight connector running in your environment to enable the secure gathering of authorization metadata for resources that Veza cannot access directly. An Insight Point is typically deployed as a Docker container or VM OVA.

![Insight Point Deployment Diagram.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-6e8f0f0d1ba59ab4d2f8df7825fc53ecab4df27d%2Finsight-point.png?alt=media)

Typically, you will want an Insight Point to enable secure discovery of services (such as Active Directory, Oracle Database, or SQL Server) that require connectivity from within your corporate network. The Insight Point will run within your network to query the internal-only data sources for authorization metadata and push that information to Veza securely.

#### When do I need an Insight Point?

Deploying an Insight Point for Veza is usually not required, but might be necessary:

* When the resources to discover are not exposed publicly.
* To discover databases and other services that do not have cloud-native APIs.
* If your organization prohibits 3rd-party programmatic access to cloud service providers.
* To discover on-premise [Active Directory](../integrations/active-directory) and [SQL Server](../integrations/sql-server).

#### Installation Options

* Veza provides an [installation script](insight-point/insight-point-install-script) to install an Insight Point for common Linux distributions.
* The Insight Point is also available as an [OVA image](insight-point/ova-v2) suitable for Oracle Virtualbox or VMWare VSphere. This option can be preferable to Docker for Windows-based environments.
* For AWS environments, see [Deploy with AWS EC2](insight-point/insight-point-ec2) for instructions to start an Insight Point on AWS EC2.

After deploying the Insight Point, you can specify it when [configuring](../configuration) an integration. Veza will use the Insight Point for secure collection and transmission of entity metadata.

#### System Requirements

Before deploying an Insight Point, ensure your environment meets the following minimum requirements:

| Resource         | Minimum Requirement                                     |
| ---------------- | ------------------------------------------------------- |
| **CPU**          | 2 cores                                                 |
| **Memory**       | 4 GB RAM                                                |
| **Storage**      | 20 GB available disk space                              |
| **Network**      | Outbound HTTPS (port 443) access to Veza tenant and ECR |
| **Architecture** | linux/amd64 or linux/arm64                              |

**Note:** These are minimum requirements for typical deployments. For large data sources, see [Known Issues](#known-issues) for additional resource recommendations. If you experience performance issues or timeouts during data collection, consider increasing CPU and memory allocation. Contact Veza support for guidance on resource scaling for your specific environment.

#### Generating an Insight Point key

Log in to Veza with an administrator account, and create a registration key by browsing to **Integrations** > _Insight Points_:

1. Click **Create**
2. Enter a `Name`
3. Click **Generate Key**
4. Copy the key for use when running the docker image

Save the Insight Point key in a secure location. If lost, there is no way to recover it.

#### Known Issues

**Large Data Source Extractions**

When connecting to very large data sources—such as Active Directory domains with 100,000+ users or databases with extensive metadata—Insight Points may experience instability during data extraction. In this case, standard minimum resources may be insufficient, leading to performance issues or service interruptions.

If the Insight Point becomes unresponsive during extraction jobs, requires manual restart to resume operation, or extraction jobs timeout before completing, these symptoms typically indicate that the Insight Point is struggling with resource constraints when processing data.

To address these issues, consider increasing resource allocation significantly beyond the minimum requirements. For Active Directory environments with 300,000+ entities, use a minimum of **8 GB RAM, 2 CPU cores, and 40 GB storage**. Monitor the Insight Point container logs for memory exhaustion or resource-related errors that can help identify the root cause of stability issues.

* Ensure the network connection between the Insight Point and target systems is stable throughout long-running extraction processes. Network interruptions can cause extraction failures that require restarting the entire process.
* For organizations with 9 or more Active Directory domains, consider deploying multiple Insight Points to distribute processing load across instances.
* For particularly large environments, contact Veza support for specific resource sizing recommendations and potential optimizations tailored to your deployment.

#### Troubleshooting

* **Insufficient Resources**: Ensure the Insight Point meets the [system requirements](#system-requirements). The instance must have at least 2 CPU cores and 4 GB RAM allocated.

Refer to specific deployment guides for troubleshooting steps.

* [Install Script](insight-point-install-script#troubleshooting)

**Checking connectivity**

The Insight Point automatically checks for connectivity on container start. This includes steps to resolve the DNS and verify TCP and HTTP communication. If there are connection problems, the container logs will indicate if a connection was refused, a host could not be found, or there is another issue.

**Monitoring Insight Point availability**

The Veza platform emits an Insight Point Unavailable event after the Insight Point is unavailable for several minutes. To reduce the number of times this event triggers, the task manager will not re-emit the event for 24h hours. An administrator can configure [event subscriptions](../../../administration/administration/events#event-subscriptions) to get email notifications when connectivity issues impact Veza data collection.

> **Note:** If the Insight Point task manager service is restarted, the event can be emitted sooner than the 24-hour window.

To enable email alerts when an Insight Point is unavailable:

1. Use the Veza navigation menu to open **Administration** > **Event Subscriptions**
2. Click **Create Subscription**
3. On the **Details** tab, enter a descriptive name to communicate the alert purpose.
4. On the **Conditions** tab:
   * Set **Event Type** to "Insight Point Unavailable"
   * Set **Severity** to "Error"
   * Set **Category** to "Integrations"
5. On the **Action → Send Alert** tab, select or create an email Veza Action
6. Click **Create** to save the subscription

![Example of Insight Point monitoring subscription](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-b1249b7002ba9acf44ca4e828d04d6ca27bfd869%2Finsight-point-monitoring.png?alt=media)

#### Changing an Insight Point

When modifying the Insight Point associated with an integration — for example, if the registration key is lost — you will need to re-enter the credentials and secrets for that integration configuration.

* Follow the instructions to start another Insight Point with a new deployment key
* On the **Integrations** page, edit the integration configuration to re-enter the credentials for each affected integration.

#### Ports and connectivity

The Insight Point will communicate out from the container VM to the Veza Tenant and targeted systems. Your implementation must enable traffic to and from the host on the required ports.

Also, the host must be able to communicate out to the ECR repository hosting the insight point image.

| Required | Destination          | Protocol | Port |
| -------- | -------------------- | -------- | ---- |
| yes      | Veza Tenant          | TCP      | 443  |
| yes      | public.ecr.aws       | TCP      | 443  |
| for AD   | AD Domain Controller | TCP/UDP  | 636  |
| for SQL  | SQL Server           | TCP      | 1433 |

* The Insight Point must be able to communicate with `https://<your-org>.vezacloud.com` on outbound port 443. Ensure that firewalls allow outbound traffic to the Veza tenant domain.
* **For Active Directory and SQL Server**: The Insight Point must be allowed to communicate with Active Directory Domain Controllers on port `636`, and SQL Servers on port `1433`.
* **For AWS RDS and Trino**: To discover AWS RDS or Trino instances, you will need to add the Insight Point egress IP to the Security Groups Inbound rules. Do this for each of the instances to discover.

To add an entry for AWS RDS:

1. Log in to the AWS account containing the resources to discover, and go to **RDS** > _Databases_
2. Click the _DB identifier_ and go to _Connectivity & security_ > _Security_ > _VPC security groups_
3. Click _Inbound rules_ > _Edit inbound rules_ to set the IP address entry
4. Click _Add rule_ > _Type_ (MySQL, Aurora or PostgreSQL) > _Source_ (Custom)
5. Enter the Insight Point egress IP
6. Optionally enter a description and click _Save rules_

To add an entry for Trino:

1. Log in to the AWS account containing the resources to discover, and go to **EC2** > _Security Groups_
2. Click the Security Group associated with your Trino instances and go to 'Inbound rules' > 'Edit inbound rules' to set the IP address entry
3. Click 'Add rule' > Type (Custom TCP) > Port Range (8080 or your custom port) > Source (Custom) > enter the Insight Point egress IP
4. Optionally enter a description, and save the rules
