Configuring SaaS Alerts

Accessing SaaS Alerts threats on your RocketCyber dashboard

Overview

The SaaS Alerts App is designed to retrieve all threat data from your SaaS Alerts dashboard and operates across all sites within it.

Required permissions

To log in to the SaaS Alert dashboard and generate the API Access Token, your account must have access to the threat data.

NOTE  Before proceeding, ensure that the SaaS Alerts app is enabled in the App Store.

How to set up

Step 1: Inserting Web receiver URL

  • Log in to the SaaS Alert dashboard.
  • From the left side navigation pane, go to Settings and select API.
  • Then, navigate to the API tab.


saas_alerts_user_and_partner_button.png

Click the Show Partner ID Button. This will reveal your unique SaaS Alerts Partner ID.
saas_alerts_user_and_partner_id_values.png

Click the Copy to Clipboard Icon next to the Partner ID Value.

In the API tab, under Webhooks API, click the + icon (Add New Domain) to input the RocketCyber web receiver URL. The web receiver URL informs SaaS Alerts that we are permitted to create a subscription link for your account and indicates that this URL will be expecting webhook alerts.

Replace YourSaasAlertsPartner ID with the value from the Partner ID Field.

  • If US customer:
    • web-receiver.us.rocketcyber.com/api/saasAlerts/YourSaaSAlertsPartnerID
  • If EU customer
    • web-receiver.eu.rocketcyber.com/api/saasAlerts/YourSaasAlertsPartnerID

NOTE  You only need to add one URL, not both, based on your location.

Click Add.

Under the Partner Domains you should now see either the US or EU (depending on your region) web receiver URL.

Step 2: Locating your API key

From the Settings > API tab select the green button Show Api Key.

An API key will be generated. Copy your API key either by highlighting it and selecting Copy -OR- by selecting the button on the right next to the textbox.

Step 3: Copying API key into Rocketcyber

Once you have copied your API key, navigate back to the Rocketcyber dashboard.

Select Integration > Cloud Security and paste your API Key inside the API Key text box.

Then, click Authenticate.

Step 4: Pulling tenants

If your API key has successfully authenticated, click Pull Tenants.

NOTE  *If your authentication failed and you received an error, please make sure that you copied the correct API key. You may also re-generate the API key within the SaaS alerts portal.

Step 5: Customer mapping

Map customers accordingly to ensure detections are routed to the correct organization. Select Save Map.

Your SaaS Alerts will now be delivered directly to your RocketCyber Dashboard under the SaaS Alerts application.