> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting SolarWinds Orion to Neo

> Publish the SolarWinds Information Service to Neo and save an Orion account

## Before you start

Neo calls your Orion server through the SolarWinds Information Service (SWIS) REST API, which listens on port **17774** of your main polling engine. Neo reaches it over the internet, so it must answer on **HTTPS** with a certificate from a public certificate authority, at a public address. SWIS's own certificate is self-signed, so most MSPs publish it through a reverse proxy.

### Publish SWIS through a reverse proxy

Publish only the API, not the web console. Put a reverse proxy at your network edge that:

* answers on a public name over HTTPS, with a certificate from a public certificate authority;
* forwards only `/SolarWinds/InformationService/v3/Json/` to `https://<your Orion server>:17774`, and refuses every other path;
* accepts connections only from [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md);
* passes the `Authorization` header through to SWIS.

Save the proxy's public address in Neo, with its port when it is not 443 (for example `https://orion-api.example.com` or `https://orion.example.com:17774`).

## 1. Create an Orion account for Neo

**1. Create the account**

In the Orion web console, open Orion's account manager (the **Manage Accounts** link on its All Settings page) and add an **Orion individual account** for Neo with a strong password. A Windows account works too: enter it as `DOMAIN\user` in Neo.

**2. Give it the rights your agents need**

Any account can read through SWIS. Turn on only the rights for the changes you want agents to make:

| Right | What it lets Neo do |
| - | - |
| Allow account to clear events, acknowledge alerts and syslogs | Acknowledge, note and clear alerts |
| Allow account to unmanage objects and mute alerts | Mute, unmute, unmanage and remanage |
| Allow node management rights | Add, change and remove nodes, and poll them now |
| Allow alert management rights | Change alert definitions and actions |
| Allow administrator rights | Accounts, credentials and Orion settings |

Use **account limitations** to keep the account to the nodes Neo should see.

## 2. Add the account in Neo

**1. Open Integrations**

In the Neo Dashboard, open [**Integrations** → **SolarWinds Orion**](https://dashboard.neoagent.io/integrations?open=solarwinds_orion), under Networking.

**2. Save the address and account**

Enter the address that publishes SWIS, the user name and the password, then click **Save settings**. Neo signs in and runs one query before saving, so a wrong address or port, a self-signed certificate, or a refused account is rejected straight away.

## 3. Turn SolarWinds Orion on per agent

Open the agent, go to its **Tools & Settings** tab, click **Networking**, and expand the **SolarWinds Orion** block. Agents see only what Neo's Orion account can see.

### Pick a preset

> **Read Only**
>
> Read nodes, alerts, events, statistics and history. Nothing is changed.

> **Helpdesk**
>
> Acknowledge, note and clear alerts without approval. Muting, unmanaging and changing nodes wait on a technician. Every other change is off.

> **IT Admin**
>
> Alerts, muting, nodes, applications, virtualization, IP addresses and dashboards change without approval, except deleting a node. Alert definitions, agents, server and VM actions, network configuration, security, credentials, accounts and settings wait on a technician.

> **Full Automation**
>
> Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician).

### Or set each area by hand

| Area | Notes |
| - | - |
| **Monitoring Data** | Every read: nodes, interfaces, volumes, applications, alerts, events, statistics and history. Disabled or Read Only. |
| **Alerts and Events** | Acknowledge, note and clear alerts, and acknowledge events and notifications. |
| **Mute and Unmanage** | Mute and unmute alerts, and unmanage or remanage nodes, interfaces, volumes and applications. |
| **Alert Definitions and Actions** | Alert definitions, their actions and schedules, SMTP servers and incident integrations. |
| **Nodes and Monitoring** | Nodes, interfaces, volumes, custom properties, pollers, groups, dependencies, discovery, thresholds, hardware health, NetFlow, NetPath and wireless. Deleting a node always waits on a technician. |
| **Agents** | Deploy, restart and uninstall Orion agents and packet analysis probes. |
| **Applications and Server Monitoring** | Application monitors and templates, server configuration, patch, web transaction, database, log and container monitoring. |
| **Server, VM and Cloud Actions** | Start, stop or restart a service, IIS site or application pool; reboot a server; power, snapshot, resize or move a VM; start, stop or delete a cloud instance. |
| **Network Configuration (NCM)** | Device configuration backups, uploads and scripts, firmware upgrades, compliance policies and jobs. |
| **Virtualization, Storage and Cloud** | Hypervisors, storage arrays and cloud accounts. |
| **IP Addresses, DHCP and DNS** | Subnets, IP addresses and reservations, DHCP scopes, DNS records and user device tracking. |
| **Dashboards, Reports and Maps** | Dashboards, views, reports and their schedules, maps and banners. |
| **Security and Compliance** | Vulnerability states, security tool connections and policies. |
| **Credentials** | Stored credentials. Every change waits on a technician. |
| **Accounts and Access** | Orion accounts, limitations, identity providers and NCM change approvals. Every change waits on a technician. |
| **Administration** | Settings, polling engines, high availability, licences and the SolarWinds platform connection. |

Monitoring Data can be Disabled or Read Only. Every other area holds changes only, so it is Disabled or Read/Write, with its own technician approval setting.

### Changes that always ask a technician

These wait on a technician under every profile, whatever the area's own approval setting:

* Any change to stored credentials or Orion accounts, and deciding an NCM change approval.
* Any change that stores or sends a credential: a password, an SNMP community or key, a token, a setting whose name says it is a credential, or the user name and password in a URL.
* Any change that names a stored credential, such as attaching a Windows credential to a node or restarting a service with one, because Orion signs in with it.
* Changing the address Orion connects to, such as a node's IP address or DNS name, because Orion sends the record's stored credentials there.
* Deleting a node, which removes its history and alerts.
* Deleting a configuration backup, and deleting or terminating a cloud instance.

### What Neo never sends

* A call that returns a credential or a decrypted value, or device configuration and script text, such as a configuration diff or search.
* An export or import of alert definitions, templates, dashboards, policies or recordings, which can carry credentials and many changes at once.
* Raw SQL against the Orion database, a subscription that sends data to another address, and uninstalling Orion.
* A bulk action that names no records, such as deleting all vulnerability data.

## Troubleshooting

| Error when you save | What to check |
| - | - |
| No SolarWinds Information Service answered | The address and its port. Enter the address that publishes SWIS, not the web console. |
| SolarWinds rejected the user name or password | The account, its password, and that it is enabled. A Windows account is entered as `DOMAIN\user`. If all are right, a proxy in front of SWIS may drop the `Authorization` header. |
| Could not reach SolarWinds | That the address answers from the internet over HTTPS with a certificate from a public certificate authority, and that Neo's addresses may reach it. |
| ... is a private or reserved address | Use the public address of your reverse proxy. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.