Skip to main content
The Admin By Request integration polls security events from your tenant API and syncs managed endpoint inventory into Wirespeed.

​
What This Integration Does

  • Polls the Admin By Request Events API
  • Ingests privilege changes, policy blocks, break-glass logons, and related endpoint events
  • Syncs managed workstations from the Inventory API
  • Maps events to Wirespeed detections with host, user, and file context when available

​
Prerequisites

Before setup, make sure you have:
  1. An Admin By Request tenant with API access enabled
  2. An API key from Settings → Tenant Settings → Data → API Keys
  3. Your tenant API data center prefix (for example dc1api, dc2api) shown under About API Keys

​
Step 1: Enable the API and Create a Key

In the Admin By Request portal:
  1. Go to Settings → Tenant Settings → Data → API Keys
  2. Create or copy an API key
  3. Note the data center prefix for your tenant (for example dc1api for EU West)
Use the correct data center prefix. Connecting to the wrong dc*api host causes API errors.

​
Step 2: Add Admin By Request in Wirespeed

  1. Go to Integrations > Add Integration
  2. Search for Admin By Request
  3. Enter:
    • API Data Center (for example dc1api)
    • API Key
    • Event Codes Filter (optional; leave blank for the default high-signal set)
  4. Click Integrate
During onboarding, Wirespeed validates credentials with GET /inventory?take=1.

​
Detection Ingestion Behavior

  • Default ingest set covers high-signal event codes (privilege changes, execution blocks, break glass, session denials)
  • Pagination uses monotonic event id cursors (startid) between runs
  • Initial sync is capped to avoid backfill floods on large tenants

​
Endpoint Inventory Behavior

  • Full directory sync on each run via GET /inventory
  • Pagination uses monotonic inventory id cursors (startid) within the run only
  • Maps hostname, OS, IP addresses, agent version, and last inventory timestamp; live status uses inventoryAvailable, with a 4-hour inventoryDate fallback per ABR’s inventory refresh interval

​
Troubleshooting

​
Authentication Failures

Check:
  1. API key is valid and API access is enabled in the portal
  2. API Data Center matches the prefix shown under About API Keys
  3. The key has not exceeded the vendor daily API quota (100,000 calls/day)

​
No Detections Appearing

Check:
  1. Admin By Request is generating events in the portal (for example policy blocks or privilege changes)
  2. Event codes are not excluded by a custom Event Codes Filter
  3. Initial sync may take a few minutes depending on backlog volume

​
Additional Resources