Skip to main content
To integrate Upwind, create API client credentials in the Upwind console and provide them to Wirespeed with your organization ID and regional API host.

​
Prerequisites

  • An Upwind account that can create API client credentials (a client ID and client secret)
  • API client access to read threat detections and threat events, and to update threat detections unless the integration is Read Only
  • Your Upwind organization ID, for example org_Xk9mPq7RtYwN2vLs
  • The API host for your Upwind region:

​
Create API Credentials

  1. Log in to the Upwind console
  2. Navigate to Settings > Access Management and open the Credentials tab
  3. Click Generate Credential
  4. Choose API as the credential type, and keep the auto-generated name or enter a friendly name such as Wirespeed
  5. Copy the Client ID and Client Secret. The secret may only be shown once

​
Add the Integration in Wirespeed

  1. In Wirespeed, navigate to Integrations > Add Integration > Upwind
  2. Check the API Host. It defaults to api.upwind.io (US); change it if your organization is in the EU or ME region
  3. Enter your Organization ID, Client ID, and Client Secret
  4. Submit the integration
Wirespeed checks the credentials, region, and organization ID when you save. A token issued for one region is rejected by the others, so the API host must match the region of your Upwind organization.

​
What Wirespeed Ingests

Wirespeed polls for detections by when Upwind last saw them, starting with the previous 24 hours. A detection that recurs after Wirespeed ingested it is not ingested again. Wirespeed polls for threat events by when Upwind first saw them, starting with the previous 24 hours. Events are read about two minutes after Upwind first sees them. If a poll fails partway through, the next poll re-reads that time range, so some events can be stored twice.

​
Detection Updates

When a detection is completed, Wirespeed archives the Upwind threat detection. Upwind has no API for comments, so analyst comments stay in Wirespeed. To prevent archiving, enable Read Only in the advanced options when you add the integration; it cannot be changed afterward.

​
Current Limitations

  • Containment and remediation actions are not available
  • Reopening a detection does not unarchive the Upwind threat detection
  • Detections do not escalate until Upwind categorization rules are defined