Skip to main content

Integrations

N
Written by Nataliia Pukaliak

Set up an integration profile to connect external security platforms to orchestrate detection rules across all your environments.

The Integrations page consists of two tabs:

  • Available – Displays all available integrations

  • Connected – Displays integrations that are already created. On this tab, you can view the connection status of your integrations (currently, connection check is only available for the Threat Detection Marketplace integration).

Set Up Integration Profile

Threat Detection Marketplace

Connect DetectFlow to Threat Detection Marketplace to access the SOC Prime Platform for threat detection content, AI-powered field mapping as well as Active Threats and related content.

  1. Go to Settings → Integrations page and select Add on the Threat Detection Marketplace tile.

  2. Enter your SOC Prime API key.

    Сreate an API key on the SOC Prime Platform and refer to the user guide for detailed instructions. Your API key will be used to authenticate requests to the SOC Prime Platform for synchronizing your cloud repositories as well as for AI-related features like field mapping generation and Active Threats with their related content. Make sure your SOC Prime Platform API key has Threat Detection Marketplace, Uncoder AI (including AI features), and DetectFlow permissions.

  3. The Push toggle is turned on by default, allowing changes made in DetectFlow to be pushed to the SOC Prime Platform. When the toggle is turned off, DetectFlow continues to pull changes from the custom repository in Threat Detection Marketplace, but local changes made in DetectFlow are not pushed back to the custom repository in Threat Detection Marketplace.

  4. Check connection status by selecting Check Connection.

  5. Select Create.

Microsoft Sentinel

Connect your Microsoft Sentinel instance to Detect Flow to investigate events that form an Attack Chain directly in your security environment.

  1. Go to Settings → Integrations page and select Add on the Microsoft Sentinel tile.

  2. Fill in the Profile Name.

  3. Fill in Microsoft Sentinel URL. It's the URL of your Microsoft Sentinel web console. Open your workspace, select Workspace Settings > Logs, and copy the full URL of the page. It should contain the following parameters: subscriptions, resource groups, providers, and workspaces.

  4. Fill in Table Names. These are the Microsoft Sentinel tables where tagged events from destination topics are stored.

  5. Optionally, fill in Remapped Sigma Rule ID Field. If you remap the Sigma Rule ID field when ingesting data from destination topics into Microsoft Sentinel, specify the new field name here.

  6. Fill in Host Name Fields. Specify the names of the fields that can contain hostnames in your SIEM data schema. This parameter is pre-filled with default data schema values that may be different from yours.

  7. Select Create.

Splunk

Connect your Splunk instance to Detect Flow to investigate events that form an Attack Chain directly in your security environment.

  1. Go to Settings → Integrations page and select Add on Splunk tile.

  2. Fill in the Profile Name.

  3. Fill in Splunk URL. It's the URL of your Splunk web console that you can copy from your browser. Do not include the port number for cloud Splunk, and add port 8000 for on-prem Splunk.

  4. Optionally fill in Custom Search App. Fill in if in Splunk you use a search app different from “default”.

  5. Optionally, fill in Index Names. These are the Splunk indexes where tagged events from destination topics are stored.

  6. Optionally, fill in Remapped Sigma Rule ID Field. If you remap the Sigma Rule ID field when ingesting data from destination topics into Splunk, specify the new field name here.

  7. Fill in Host Name Fields. Specify the names of the fields that can contain hostnames in your SIEM data schema. This parameter is pre-filled with default data schema values that may be different from yours.

  8. Select Create.

Elastic Stack

Connect your Elastic Stack instance to Detect Flow to investigate events that form an Attack Chain directly in your security environment.

  1. Go to Settings → Integrations page and select Add on Elastic Stack tile.

  2. Fill in the Profile Name.

  3. Fill in Kibana URL. It's the URL of your Kibana web console that you can copy from your browser. It should contain the hostname and port number (unless the default port 443 is used).

  4. Fill in Kibana space URL identifier. If left empty, the default space is used. Fill in this field to use a different space. The URL identifier is a short text string that becomes part of the Kibana URL when you are inside that space. Learn More

  5. Fill in Index Pattern ID. Set an ID of the index pattern where events from destination topics are stored.

  6. Optionally, fill in Remapped Sigma Rule ID Field. If you remap the Sigma Rule ID field when ingesting data from destination topics into Elastic, specify the new field name here.

  7. Fill in Host Name Fields. Specify the names of the fields that can contain hostnames in your SIEM data schema. This parameter is pre-filled with default data schema values that may be different from yours.

  8. Select Create.

OpenSearch

Connect your OpenSearch instance to Detect Flow to investigate events that form an Attack Chain directly in your security environment.

  1. Go to Settings → Integrations page and select Add on OpenSearch tile.

  2. Fill in the Profile Name.

  3. Fill in OpenSearch URL. It's the URL of your web console ending with “/discover“. Copy it from your browser when on the Discover page.

  4. Fill in Index Pattern ID. Set an ID of the index pattern where events from destination topics are stored

  5. Optionally, fill in Remapped Sigma Rule ID Field. If you remap the Sigma Rule ID field when ingesting data from destination topics into AWS OpenSearch, specify the new field name here.

  6. Fill in Host Name Fields. Specify the names of the fields that can contain hostnames in your SIEM data schema. This parameter is pre-filled with default data schema values that may be different from yours.

  7. Select Create.

GitLab

Synchronize Sigma rules with a GitLab project.

  1. Go to Settings → Integrations page and select Add on GitLab tile.

  2. Provide the name of the profile in the Profile Name field.

  3. Fill in the following fields:

    • Base URL. Paste GitLab host base URL.

    • Project Path. Enter the path to your GitLab project without .git (e.g. group/subgroup/project).

    • Subpath. Enter directory within the repo that holds Sigma rules (empty = repo root).

    • Ca Cert. Provide custom CA certificate chain (PEM) used to verify a self-hosted GitLab host behind a private CA. This field is preferred over disabling the Verify Ssl toggle. Leave the field empty to use the system CA store.

    • Token. Provide personal, project, or group access token. You can learn how to create it here.

    • Branch. Specify a branch to pull from and push to.

  4. Use the toggles to enable or disable the following options:

    • Verify Ssl. Enables verification of TLS certificates. Disable this toggle only as a last resort for self-signed hosts.

    • Auto Pull. Enables to automatically pull rules from GitLab to DetectFlow. The same setting can be managed in the Repositories section using the Turn Sync Off option in the repository context menu. Disabling synchronization for a repository disables Auto Pull for that repository.

  5. Select Create.

    Note:

    • The fields Base URL, Project Path, Subpath, and Branch can’t be edited after the integration profile has been created. To change the field values, delete the existing profile and create a new one.

    • You can create multiple GitLab integration profiles.

Once the GitLab integration profile is created, a corresponding repository appears on the Repositories page containing Sigma rules synchronized from GitLab. After the initial synchronization, DetectFlow pulls only the content that has changed in the GitLab project since the last synchronization.

The name of the repository in DetectFlow corresponds to the name of the integration profile created for the GitLab project. The repository structure in DetectFlow mirrors the structure of the connected GitLab project.

In DetectFlow you can manage Sigma rules pulled from your GitLab project by editing or deleting them. Note that you can not create new rules directly in DetectFlow. To add a new rule, create it in your GitLab project, and it will be synchronized to DetectFlow.

To synchronize rule updates or deletions in DetectFlow with GitLab, edit or delete a rule in DetectFlow and push the changes to GitLab. To do this:

  1. Go to the Repositories page and select your GitLab repository from the left sidebar.

  2. On the right, you can see the list of rules synchronized from GitLab.

    • To update a rule, select Edit rule, make necessary changes and select Save & Push to create a commit directly in GitLab (not a merge request).

    • To delete a rule, select View rule, then Delete.

    If the rule has been modified in GitLab after the last synchronization, DetectFlow notifies you about the conflict. In the appeared modal, select Force Push option to overwrite the changes in GitLab with the changes made in DetectFlow.

    Note: When changes are pushed to GitLab, the commit author is the current user.

Deleting a GitLab integration profile removes the associated repository and all rules contained within it.

Edit or Delete Integration Profile

To edit or remove an integration profile:

  1. Go to Settings → Integrations page and select the Connected tab.

  2. Find the desired integration and click the Edit icon.

  3. Update the profile settings and click Update, or select the Delete button and confirm your action.

Related Articles
Did this answer your question?