> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Upwind

> Ingest Upwind cloud and workload threat detections as detections and threat events as logs

To integrate Upwind, create API client credentials in the Upwind console and provide them to Wirespeed with your organization ID and regional API host.

## Prerequisites

* An Upwind account that can create API client credentials (a client ID and client secret)
* API client access to read threat detections and threat events, and to update threat detections unless the integration is **Read Only**
* Your Upwind organization ID, for example `org_Xk9mPq7RtYwN2vLs`
* The API host for your Upwind region:

| Region | API Host |
| - | - |
| US | `api.upwind.io` |
| EU | `api.eu.upwind.io` |
| Middle East | `api.me.upwind.io` |

## Create API Credentials

1. Log in to the Upwind console
2. Navigate to **Settings** > **Access Management** and open the **Credentials** tab
3. Click **Generate Credential**
4. Choose **API** as the credential type, and keep the auto-generated name or enter a friendly name such as `Wirespeed`
5. Copy the **Client ID** and **Client Secret**. The secret may only be shown once

## Add the Integration in Wirespeed

1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Upwind**
2. Check the **API Host**. It defaults to `api.upwind.io` (US); change it if your organization is in the EU or ME region
3. Enter your **Organization ID**, **Client ID**, and **Client Secret**
4. Submit the integration

Wirespeed checks the credentials, region, and organization ID when you save. A token issued for one region is rejected by the others, so the API host must match the region of your Upwind organization.

## What Wirespeed Ingests

| Source | Upwind API | Purpose |
| - | - | - |
| Threat detections | `GET /v1/organizations/{organization-id}/threat-detections` | Detections with the affected cloud resource and account, MITRE ATT\&CK context, and the processes, files, bad-reputation network peers, and audit-log or CloudTrail principals from each trigger |
| Threat events | `GET /v1/organizations/{organization-id}/threat-events` | Process executions, malicious file activity, bad-reputation network activity, Kubernetes and cloud audit-log events, CloudTrail events, and threat violation evidence, stored as logs |

Wirespeed polls for detections by when Upwind last saw them, starting with the previous 24 hours. A detection that recurs after Wirespeed ingested it is not ingested again.

Wirespeed polls for threat events by when Upwind first saw them, starting with the previous 24 hours. Events are read about two minutes after Upwind first sees them. If a poll fails partway through, the next poll re-reads that time range, so some events can be stored twice.

## Detection Updates

When a detection is completed, Wirespeed archives the Upwind threat detection. Upwind has no API for comments, so analyst comments stay in Wirespeed. To prevent archiving, enable **Read Only** in the advanced options when you add the integration; it cannot be changed afterward.

## Current Limitations

* Containment and remediation actions are not available
* Reopening a detection does not unarchive the Upwind threat detection
* Detections do not escalate until Upwind categorization rules are defined


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.