> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandfly

> Ingest Sandfly alert results and sync Linux host inventory for enrichment

The Sandfly integration ingests Linux detection results from Sandfly and correlates them to host inventory in Wirespeed.

## What This Integration Does

* Ingests Sandfly `alert` results into Wirespeed detections
* Syncs Sandfly hosts as endpoint assets
* Correlates detections to endpoint inventory in Wirespeed for host context

## Prerequisites

Before setup, make sure you have:

1. The **hostname or IP address** of your Sandfly server (reachable from Wirespeed)
2. A dedicated Sandfly API user with read-only access (recommended role: `api_result_read`)
3. The API user's username and password

## Step 1: Create a Read-Only API User in Sandfly

In Sandfly, create a dedicated integration user and assign read permissions only (prefer `api_result_read`).

<Warning>
  Use a dedicated service account for Wirespeed instead of a personal admin account.
</Warning>

## Step 2: Add Sandfly in Wirespeed

1. Go to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Search for **Sandfly**
3. Enter:
   * **Sandfly Host** (hostname or IP, no protocol/path; for example `sandfly.company.com` or `142.250.190.46`)
   * **API Username**
   * **API Password**
4. Click **Integrate**

During onboarding, Wirespeed validates:

* Credential correctness (`/v4/auth/login`)
* API reachability and token validity (`/v4/version`)

## Detection Ingestion Behavior

* Only `alert` status results are ingested
* `pass` and `error` results are ignored
* Whitelisted and superseded results are excluded
* Cursor-based polling uses `time_since` to avoid gaps and duplicates

## Endpoint Inventory and Enrichment

* Host inventory sync uses Sandfly host summaries (`/v4/hosts?summary=true`)
* Host context is attached to detections through Wirespeed endpoint correlation

## Troubleshooting

### Authentication or Validation Failures

Check:

1. Hostname/IP is correct and reachable from Wirespeed
2. Wirespeed can reach your Sandfly API over HTTPS
3. Username/password are valid
4. The API user has read access to results and hosts

### No Detections Appearing

Check:

1. Sandfly has recent `alert` results (not only `pass`/`error`)
2. Results are not whitelisted or superseded
3. Initial sync may take a few minutes depending on volume

## Additional Resources

* [Sandfly API Overview](https://docs.sandflysecurity.com/docs/sandfly-api)
* [Sandfly API Reference](https://api.sandflysecurity.com/)