This playbook uses New Relic, a third-party tool. We aim to keep these details accurate, but we can't guarantee they're always complete or up to date. For the most reliable information, refer to the New Relic documentation.
Your network changes constantly. Most changes are routine. Some are the first sign of a problem: a firewall rule changed outside a change window, or a new critical vulnerability appearing on a device the same day it drifts.
Lansweeper sees asset changes and vulnerabilities as its data updates. This playbook covers four Flow Builder workflows that send that data to New Relic as queryable events, so your monitoring team can see drift and exposure signals in the same place they watch everything else.
What the four workflows do
| Workflow | Trigger | New Relic event type | What it sends |
|---|---|---|---|
| Critical Asset Drift Watch | Asset updated | LansweeperAssetDrift |
1 event for each firewall, router, or switch that changes |
| Critical Asset Exposure | Asset updated | LansweeperCriticalExposure |
1 event for each critical vulnerability found on a firewall, router, or switch that just changed |
| Critical Exposure Pulse | Schedule (weekdays, 12:00) | LansweeperExposure |
1 event for each active critical vulnerability across your whole estate |
| Shadow Asset Detection | Asset created | LansweeperNewAsset |
1 event for each new asset with no domain value set |
Use all 4 together for full coverage: drift on critical devices, exposure that coincides with drift, a scheduled sweep of all exposure, and detection of assets you did not expect to see. You can also enable them individually.
What you will need
Before you start, make sure you have:
- A Lansweeper site with Flow Builder enabled
- A New Relic account (sign up at newrelic.com/signup)
- Admin access to your New Relic account, to create an ingest license key
- Edit access to Flow Builder, to configure the workflows
Set up New Relic
Each workflow sends events using the New Relic connector's Send Event Data action. To receive them, you need an ingest license key and your account ID.
Create an ingest license key
- In New Relic, go to your account settings.
- Select API keys.
- Create a new key with the type Ingest - License.
- Copy the key. You need it when you add the connection.
Find your New Relic account ID
- In New Relic, select the account menu in the top-right corner.
- Note your account ID. You need it for every workflow.
Add a New Relic connection in Flow Builder
- In Flow Builder, go to Connections.
- Add a new connection for New Relic, using the license key you created.
- Set the region to match where New Relic hosts your account: US or EU.
The workflows
Workflow 1: Critical Asset Drift Watch
Purpose: send an event for every firewall, router, or switch that Lansweeper detects as updated.
How it works
- Trigger. The workflow fires on the Lansweeper asset-updated event.
- Set account ID. This step stores your New Relic account ID for later steps to reuse.
- Repeat for each event. A single trigger run can carry more than 1 change. This step loops over each change on its own.
- Get asset details. For each change, the workflow looks up the asset's name, type, IP address, operating system, and other fields.
- IF critical device. The workflow checks whether the asset type is Firewall, Router, or Switch. If it matches none of these, the workflow sends no event for that asset.
- Send event data. For a matching asset, the workflow sends a
LansweeperAssetDriftevent to New Relic.
Setup and customization
- New Relic connection: open the Send Event Data step and select the connection you set up earlier.
- Account ID: open the Set Account ID step and replace the placeholder value with your own New Relic account ID.
- Critical device definition: open the IF critical device step to see the condition. Add or remove asset types so the condition matches which devices count as critical for your organization. You can also add other fields to the condition, such as asset location or department, to tailor it further.
What the event contains
| Field | Value | Purpose |
|---|---|---|
| assetKey | Lansweeper's unique ID for the asset | Links the event back to a specific asset |
| assetURL | Link to the asset in Lansweeper | 1 click from New Relic to the full asset record |
| assetName | Asset name | Identifies the device |
| assetType | Firewall, Router, or Switch | Lets you filter and group by device type |
| hostname | Fully qualified domain name | Identifies the device on the network |
| source | "Lansweeper" | Identifies where the event came from |
| triggerEvent | The Lansweeper event type | Confirms what kind of change fired the workflow |
| lastUpdated | Last update timestamp | Shows when Lansweeper last saw a change |
Workflow 2: Critical Asset Exposure
Purpose: when a firewall, router, or switch changes, check it for critical vulnerabilities straight away, instead of waiting for the next scheduled sweep.
How it works
- Trigger. The workflow fires on the Lansweeper asset-updated event.
- Set account ID. This step stores your New Relic account ID for later steps to reuse.
- Repeat for each event. The workflow loops over each change on its own.
- Get asset details. For each change, the workflow looks up the asset's name, type and other fields.
- IF critical device. The workflow checks whether the asset type is Firewall, Router, or Switch. If it matches none of these, the workflow stops for that asset.
- List critical vulnerabilities. For a matching asset, the workflow checks for vulnerabilities with a severity of Critical.
- Check vulnerabilities found, else skip. If the check finds no critical vulnerability, the workflow stops for that asset and sends no event.
- Repeat for each vulnerability. The workflow loops over each critical vulnerability found on the asset.
- Send event data. For each vulnerability, the workflow sends a
LansweeperCriticalExposureevent to New Relic.
Setup and customization
- New Relic connection: open the Send Event Data step and select the connection you set up earlier.
- Account ID: open the Set Account ID step and replace the placeholder value with your own New Relic account ID.
- Critical device definition: open the IF critical device step to add or remove asset types.
- Critical vulnerability definition: open the List Critical Vulnerabilities in Assets step. It checks for a severity of Critical. Add a condition for CISA-exploited vulnerabilities if you want those included regardless of severity.
What the event contains
| Field | Value | Purpose |
|---|---|---|
| assetKey | Lansweeper's unique ID for the asset | Links the event back to a specific asset |
| assetURL | Link to the asset in Lansweeper | 1 click from New Relic to the full asset record |
| assetName | Asset name | Identifies the device |
| assetType | Firewall, Router, or Switch | Lets you filter and group by device type |
| hostname | Fully qualified domain name | Identifies the device on the network |
| CVE | Vulnerability identifier | Identifies the specific vulnerability |
| severity | Vulnerability severity | Confirms the vulnerability is Critical |
| CVSS | CVSS base score | Shows how severe the vulnerability is on a 0-10 scale |
Workflow 3: Critical Exposure Pulse
Purpose: on a schedule, send every active critical vulnerability across your estate to New Relic, so your team has a regular exposure snapshot without leaving New Relic.
How it works
- Trigger. The workflow runs on a schedule. It ships set to run at 12:00, Monday to Friday, in the Europe/London time zone.
- Set account ID. This step stores your New Relic account ID for later steps to reuse.
- List vulnerabilities. The workflow lists active vulnerabilities that match the severity filter. It ships filtering for Critical severity with a High confidentiality impact score.
- Repeat for each event. The workflow loops over each vulnerability found.
- Send event data. For each vulnerability, the workflow sends a
LansweeperExposureevent to New Relic.
Setup and customization
- New Relic connection: open the Send Event Data step and select the connection you set up earlier.
- Account ID: open the Set Account ID step and replace the placeholder value with your own New Relic account ID.
- Schedule: open the Schedule trigger step to change how often the workflow runs.
- Severity filter: open the List Vulnerabilities in Assets step to change which vulnerabilities count as in scope for your organization.
What the event contains
| Field | Value | Purpose |
|---|---|---|
| cve | Vulnerability identifier | Identifies the specific vulnerability |
| riskScore | Lansweeper risk score | Ranks vulnerabilities by overall risk |
| publishedOn | Date the vulnerability was published | Shows how long the vulnerability has existed |
| severity | Vulnerability severity | Confirms the vulnerability matches your filter |
| attackVector | How the vulnerability can be exploited | Helps prioritize network-reachable vulnerabilities |
| attackComplexity | How difficult the vulnerability is to exploit | Helps prioritize easily exploited vulnerabilities |
| source | Vulnerability data source (for example, Microsoft, Mozilla, Apple) | Identifies the vendor advisory the vulnerability came from |
| url | Link to the trigger run | Traces the event back to the scheduled run that sent it |
Workflow 4: Shadow Asset Detection
Purpose: send an event for every newly discovered asset with no domain value set, so unexpected devices get flagged as soon as they appear.
How it works
- Trigger. The workflow fires on the Lansweeper asset-created event.
- Set account ID. This step stores your New Relic account ID for later steps to reuse.
- Repeat for each event. The workflow loops over each new asset on its own.
- Get asset details. For each new asset, the workflow looks up its domain and other fields.
- Expected pattern? The workflow checks whether the asset's domain field is blank.
- Send event data. If the domain field is blank, the workflow sends a
LansweeperNewAssetevent to New Relic. If the asset has a domain value, the workflow sends no event.
This is a starting filter, not a complete shadow-asset check. A device can have a domain value and still be unexpected. Add your own conditions to the Expected pattern? step, for example a check against your organization's approved domain list, to narrow the filter further.
Setup and customization
- Expected pattern filter: open the Expected pattern? step to see or change the condition. For example, add conditions here to also flag assets whose domain does not match your organization's approved list.
- New Relic connection: open the Send Event Data step and select the connection you set up earlier.
- Account ID: open the Set Account ID step and replace the placeholder value with your own New Relic account ID.
What the event contains
| Field | Value | Purpose |
|---|---|---|
| assetKey | Lansweeper's unique ID for the asset | Links the event back to a specific asset |
| assetURL | Link to the asset in Lansweeper | 1 click from New Relic to the full asset record |
| assetName | Asset name | Identifies the device |
| assetType | Asset type | Shows what kind of device was discovered |
| dns_name | DNS name | Identifies the device on the network |
| ip_address | IP address | Identifies the device on the network |
Checking results in New Relic
After you enable the workflows, run these NRQL queries in New Relic to confirm events are arriving.
All drift events in the last 24 hours:
SELECT * FROM LansweeperAssetDrift SINCE 24 hours ago
Critical exposure found on a changed device:
SELECT * FROM LansweeperCriticalExposure SINCE 24 hours ago
Scheduled exposure sweep results:
SELECT count(*) FROM LansweeperExposure FACET severity SINCE 7 days ago
New assets with no domain set:
SELECT * FROM LansweeperNewAsset SINCE 24 hours ago
If events are not appearing, check the following:
- The Set Account ID step in each workflow has your real New Relic account ID, not the placeholder.
- The New Relic connection uses the correct region: US or EU.
- The IF critical device condition matches the exact asset type spelling used in Lansweeper.
- For Shadow Asset Detection, at least 1 test asset has a genuinely blank domain field.
Summary
- In New Relic, create an ingest license key and note your account ID.
- In Flow Builder, add a New Relic connection using the key, and set the correct region.
- For each workflow, open Set Account ID and replace the placeholder with your account ID.
- For Shadow Asset Detection, decide whether the blank-domain check alone is enough, or add a domain allow-list condition.
- Check the critical device definition in Workflow 1 and Workflow 2 matches the asset types your organization treats as critical.
- Enable the workflows you need. Make a test change to a firewall, router, or switch, and confirm the matching events reach New Relic.
The result is a New Relic view of drift and exposure that updates as your network changes, with no manual lookups and no switching between systems to work out what happened.