> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# DefensX API

> Answer DefensX user requests, keep each client's allow and block lists and policies, and read browsing logs, users, agents and usage

The common use is a ticket from a user DefensX blocked: the agent finds the site the user asked for, checks it in the client's logs, adds it to the client's allow list once that is allowed, and closes the ticket.

> [!NOTE]
>
> Automatically enabled when you configure DefensX permissions in your agent workflow.

## What It Does

* Read a user's request for a blocked site from its ticket, and find what was blocked in the client's URL and DNS logs
* Add sites to a client's allow and block lists (custom URL groups) and remove them, create and delete lists
* Read a client's policy groups, link a list to a policy, and create, change or delete policies
* Read URL, DNS, credential, file transfer, consent and isolation logs, top blocked sites and categories, and the cyber resilience score
* Read a client's users, groups, installed agents, deployments and browser extensions
* Read your DefensX customers and usage, and create a customer

## Permission Groups

| Group | Access levels | Covers |
| - | - | - |
| Allow and Block Lists | Disabled, Read Only, Read/Write | Custom URL groups and the sites in them, which policies use as allow, block, isolate or read-only lists |
| Policies | Disabled, Read Only, Read/Write | Policy groups: who each covers, filter categories and risk actions, and the lists each uses |
| Customers | Disabled, Read Only, Read/Write | Your DefensX customers with their domains, products and templates; creating a customer starts a DefensX subscription |
| Users, Agents and Extensions | Disabled, Read Only | Users and groups, installed agents and deployments (Neo removes install tokens), browser extensions |
| Logs and Reports | Disabled, Read Only | URL, DNS, credential, file transfer, consent and isolation logs (Neo removes query strings from logged addresses), top sites and categories, cyber resilience |
| Usage | Disabled, Read Only | Billed and current usage per client and subscription |

Neo always asks a technician before a policy change that turns a filter off, or that changes which lists a policy uses, whatever the group's approval setting. On a ticket, the agent works only on the DefensX customer mapped to the ticket's company.

## Setup

See [Connecting DefensX to Neo](https://docs.neoagent.io/integrations/defensx/connecting-to-neo.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.