Integration: RocketCyber and Webroot Monitor

RocketCyber

NAVIGATION  Provider level: Integrations > Endpoint Security > Webroot Monitor

PERMISSIONS  Permission to manage integrations in RocketCyber

Webroot Monitor

NAVIGATION  Settings > Unity API Access

NAVIGATION  Settings > Account Information

PERMISSIONS  Webroot account with access to create Unity API credentials and view account information

The RocketCyber and Webroot integration retrieves Webroot threat data and surfaces it in RocketCyber, enabling the SOC to monitor and respond to threats across connected Webroot organizations.

Prerequisites

  • The Webroot instance must be configured as an MSP in order for the Unity API Access menu to be available.

  • This integration requires the following information from OpenText Webroot:

    • Username

    • Password

    • Client ID

    • Client Secret

    • GSM Key (Parent Keycode)

    The Username and Password are the same credentials used to sign in to the OpenText Management Console.

How to...

To generate the credentials required for the integration, complete the following steps:

  1. Log in to the OpenText Management Console.

  2. Navigate to Settings > Unity API Access.

  3. Click Create New Client Credential.

  4. Enter a name and description for the credential.

  5. Click Next.

  6. Select Yes for Do you plan to use the Event Notification API?

  7. Select EDR/MDR service as the integration type.

  8. Click Save to complete the wizard.

  9. Copy and securely store the generated Client ID and Client Secret.

IMPORTANT  If Event Notification API support is not enabled, Webroot detections will not be ingested into RocketCyber.

IMPORTANT  The Client Secret is displayed only when it is created. If it is lost, you must generate a new credential.

  1. In the OpenText Management Console, navigate to Settings > Account Information.

  2. Locate and copy the Parent Keycode (GSM Key).

  1. Log in to RocketCyber at the provider level.

  2. Navigate to Integrations.

  3. Under Endpoint Security, select the Webroot Monitor tab.

  4. Enter the following values:

    • Username

    • Password

    • Client ID

    • Client Secret

    • GSM Key (Parent Keycode)

  5. Select Credential Test.

  6. If the credential test succeeds, select Authenticate

After authentication, RocketCyber displays the Webroot Monitor configuration page. If Webroot entities are available, map each Webroot entity to the appropriate RocketCyber organization.

Click Save Map to save the configuration.

Results

  • Webroot detections are routed to mapped RocketCyber organizations.

  • Threat activity becomes available for SOC monitoring and response.

  • PSA tickets can be associated with the appropriate organization through the mapping configuration.

If new organizations are added to Webroot or RocketCyber after the integration is configured:

  1. Open the Webroot Monitor integration.

  2. Click Pull Tenants.

  3. Review any newly discovered organizations.

  4. Update the organization mappings as needed.

  5. Click Save Map.

To remove the Webroot Monitor integration:

  1. Navigate to Integrations > Endpoint Security > Webroot Monitor.

  2. Click Clear Existing Credential.

Results

  • The Webroot credentials are removed from RocketCyber.

  • An Account removal initiated message is displayed.

  • RocketCyber can no longer authenticate to Webroot using the removed credentials.

  • Existing Webroot deployments and configurations remain unchanged.

NOTE  Alternatively, you can revoke the API credential from the OpenText Management Console by navigating to Settings > Unity API Access, selecting the credential, and clicking Delete. This revokes the API credential used by RocketCyber.

FAQ

Verify that the Username, Password, Client ID, Client Secret, and GSM Key (Parent Keycode) are entered correctly. Also verify that the Webroot account has access to the organizations being integrated and that the Client Secret has not been regenerated.