# Bulk contain multiple assets Source: https://docs.wirespeed.co/api-reference/asset/bulk-contain-multiple-assets https://api.wirespeed.co/v1/openapi.json post /v1/asset/bulk/contain Accepts remediation for each selected asset and returns the accepted operation ids to poll until provider remediation completes. # Bulk uncontain multiple assets Source: https://docs.wirespeed.co/api-reference/asset/bulk-uncontain-multiple-assets https://api.wirespeed.co/v1/openapi.json post /v1/asset/bulk/uncontain Accepts release for each selected asset and returns the accepted operation ids to poll until provider remediation completes. # Contain directory user Source: https://docs.wirespeed.co/api-reference/asset/contain-directory-user https://api.wirespeed.co/v1/openapi.json post /v1/asset/directory/{id}/contain # Contain endpoint Source: https://docs.wirespeed.co/api-reference/asset/contain-endpoint https://api.wirespeed.co/v1/openapi.json post /v1/asset/endpoint/{id}/contain # Contain file Source: https://docs.wirespeed.co/api-reference/asset/contain-file https://api.wirespeed.co/v1/openapi.json post /v1/asset/file/{id}/contain # Get active containment actions for an asset Source: https://docs.wirespeed.co/api-reference/asset/get-active-containment-actions-for-an-asset https://api.wirespeed.co/v1/openapi.json get /v1/asset/containment-status/{assetType}/{id} # Get all assets for a case Source: https://docs.wirespeed.co/api-reference/asset/get-all-assets-for-a-case https://api.wirespeed.co/v1/openapi.json get /v1/asset/case/{id} # Get asset counts by type Source: https://docs.wirespeed.co/api-reference/asset/get-asset-counts-by-type https://api.wirespeed.co/v1/openapi.json get /v1/asset/counts # Get containment action history for an asset Source: https://docs.wirespeed.co/api-reference/asset/get-containment-action-history-for-an-asset https://api.wirespeed.co/v1/openapi.json get /v1/asset/containment-history/{assetType}/{id} # Uncontain directory Source: https://docs.wirespeed.co/api-reference/asset/uncontain-directory https://api.wirespeed.co/v1/openapi.json post /v1/asset/directory/{id}/uncontain # Uncontain endpoint Source: https://docs.wirespeed.co/api-reference/asset/uncontain-endpoint https://api.wirespeed.co/v1/openapi.json post /v1/asset/endpoint/{id}/uncontain # Uncontain file Source: https://docs.wirespeed.co/api-reference/asset/uncontain-file https://api.wirespeed.co/v1/openapi.json post /v1/asset/file/{id}/uncontain # Authentication Source: https://docs.wirespeed.co/api-reference/authentication Create a team API key and authenticate Wirespeed API requests For programmatic access to the public API, use a **team API key** sent as a Bearer token. Browser sessions authenticated through the Wirespeed UI also work on `/v1` endpoints, but integrations and automation should use a team API key. ## Create an API key 1. Sign in as a team **Admin** (only Admins can access Team API Keys). 2. In Wirespeed, open **Settings → Team**. 3. Scroll to **Team API Keys**. 4. Create a key with a name, [role](/settings/roles), and expiration (1–720 days). 5. Copy the token immediately — it is shown **only once**. Keys are prefixed with `wspd-`. See [Team Settings](/settings/team) for full details on team API keys and permissions. If you lose a team API key, delete it and create a new one. Existing keys cannot be viewed again after creation. ## Send the key with requests Include the full key (including the `wspd-` prefix) in the `Authorization` header: ```bash theme={null} curl https://api.wirespeed.co/v1/... \ -H "Authorization: Bearer wspd-YOUR_TEAM_API_KEY" ``` In the API playground on each endpoint page, paste the same value into the **Authorization** field (Bearer token). Do not paste production API keys into shared or untrusted API playgrounds. Prefer curl or your own test environment when handling real credentials. ## Check which identity and role a key has Call `GET /v1/auth/me` to see the identity behind a key and the role it grants: ```bash theme={null} curl https://api.wirespeed.co/v1/auth/me \ -H "Authorization: Bearer wspd-YOUR_TEAM_API_KEY" ``` The `role` field is the permission level the key itself carries, and `teamId` is the team it acts on. A team API key authenticates as a service account user, so the user endpoints describe that service account rather than the key's own permissions. Use `/v1/auth/me` to confirm a key's role. # Get current authenticated user information Source: https://docs.wirespeed.co/api-reference/authentication/get-current-authenticated-user-information https://api.wirespeed.co/v1/openapi.json get /v1/auth/me Resolves the identity behind the bearer token, including the role it grants. API keys authenticate as their service account user, so this is how a caller discovers the effective role of a key. # Get all detections for a case Source: https://docs.wirespeed.co/api-reference/cases/get-all-detections-for-a-case https://api.wirespeed.co/v1/openapi.json get /v1/cases/{id}/detections # Get all detections for a case without entities Source: https://docs.wirespeed.co/api-reference/cases/get-all-detections-for-a-case-without-entities https://api.wirespeed.co/v1/openapi.json get /v1/cases/{id}/detections/list # Get case by ID or SID Source: https://docs.wirespeed.co/api-reference/cases/get-case-by-id-or-sid https://api.wirespeed.co/v1/openapi.json get /v1/cases/{idOrSid} # Get case counts grouped by team Source: https://docs.wirespeed.co/api-reference/cases/get-case-counts-grouped-by-team https://api.wirespeed.co/v1/openapi.json post /v1/cases/count/by-team # Get case statistics by category class Source: https://docs.wirespeed.co/api-reference/cases/get-case-statistics-by-category-class https://api.wirespeed.co/v1/openapi.json post /v1/cases/stats/category-class # Get case statistics by severity Source: https://docs.wirespeed.co/api-reference/cases/get-case-statistics-by-severity https://api.wirespeed.co/v1/openapi.json post /v1/cases/stats/severity # Get cases search count Source: https://docs.wirespeed.co/api-reference/cases/get-cases-search-count https://api.wirespeed.co/v1/openapi.json post /v1/cases/count Returns total count of cases matching the same filters as the search endpoint. # Get MTTD/MTTV/MTTR/MTTC for cases matching search filters Source: https://docs.wirespeed.co/api-reference/cases/get-mttdmttvmttrmttc-for-cases-matching-search-filters https://api.wirespeed.co/v1/openapi.json post /v1/cases/metrics Averages time-to-detect, time-to-verdict, time-to-remediate, and time-to-close across all cases matching the same filters as the search endpoint. Pagination and sort fields are ignored. # Get related cases Source: https://docs.wirespeed.co/api-reference/cases/get-related-cases https://api.wirespeed.co/v1/openapi.json get /v1/cases/{id}/related # Get threat indicators for a case Source: https://docs.wirespeed.co/api-reference/cases/get-threat-indicators-for-a-case https://api.wirespeed.co/v1/openapi.json get /v1/cases/{id}/threat-indicators # Get TTD/TTV/TTR/TTC metrics for a case Source: https://docs.wirespeed.co/api-reference/cases/get-ttdttvttrttc-metrics-for-a-case https://api.wirespeed.co/v1/openapi.json get /v1/cases/{id}/metrics # Get weekly case counts Source: https://docs.wirespeed.co/api-reference/cases/get-weekly-case-counts https://api.wirespeed.co/v1/openapi.json get /v1/cases/count/weekly # Search and list cases Source: https://docs.wirespeed.co/api-reference/cases/search-and-list-cases https://api.wirespeed.co/v1/openapi.json post /v1/cases # Update case details Source: https://docs.wirespeed.co/api-reference/cases/update-case-details https://api.wirespeed.co/v1/openapi.json patch /v1/cases/{id} # Average MTTD and MTTV across detections matching search filters Source: https://docs.wirespeed.co/api-reference/detection/average-mttd-and-mttv-across-detections-matching-search-filters https://api.wirespeed.co/v1/openapi.json post /v1/detection/metrics # Calculate mean time to close for the team Source: https://docs.wirespeed.co/api-reference/detection/calculate-mean-time-to-close-for-the-team https://api.wirespeed.co/v1/openapi.json post /v1/detection/mean-time-to-close # Calculate mean time to detect Source: https://docs.wirespeed.co/api-reference/detection/calculate-mean-time-to-detect https://api.wirespeed.co/v1/openapi.json post /v1/detection/mean-time-to-detect # Calculate mean time to remediate for the team Source: https://docs.wirespeed.co/api-reference/detection/calculate-mean-time-to-remediate-for-the-team https://api.wirespeed.co/v1/openapi.json post /v1/detection/mean-time-to-remediate # Calculate mean time to verdict Source: https://docs.wirespeed.co/api-reference/detection/calculate-mean-time-to-verdict https://api.wirespeed.co/v1/openapi.json post /v1/detection/mean-time-to-verdict # Compare an identity detection's login against user and team authentication baselines Source: https://docs.wirespeed.co/api-reference/detection/compare-an-identity-detections-login-against-user-and-team-authentication-baselines https://api.wirespeed.co/v1/openapi.json get /v1/detection/{id}/identity-baseline # Count detections matching search filters Source: https://docs.wirespeed.co/api-reference/detection/count-detections-matching-search-filters https://api.wirespeed.co/v1/openapi.json post /v1/detection/count # Get detection by ID or SID Source: https://docs.wirespeed.co/api-reference/detection/get-detection-by-id-or-sid https://api.wirespeed.co/v1/openapi.json get /v1/detection/{idOrSid} # Get detection statistics by category class Source: https://docs.wirespeed.co/api-reference/detection/get-detection-statistics-by-category-class https://api.wirespeed.co/v1/openapi.json post /v1/detection/stats/category-class # Get detection statistics by severity Source: https://docs.wirespeed.co/api-reference/detection/get-detection-statistics-by-severity https://api.wirespeed.co/v1/openapi.json post /v1/detection/stats/severity # Get noise reduction summary statistics Source: https://docs.wirespeed.co/api-reference/detection/get-noise-reduction-summary-statistics https://api.wirespeed.co/v1/openapi.json post /v1/detection/stats/noise-reduction-summary # Get time-to-detect and time-to-verdict metrics for a single detection Source: https://docs.wirespeed.co/api-reference/detection/get-time-to-detect-and-time-to-verdict-metrics-for-a-single-detection https://api.wirespeed.co/v1/openapi.json get /v1/detection/{id}/metrics # Search and list detections Source: https://docs.wirespeed.co/api-reference/detection/search-and-list-detections https://api.wirespeed.co/v1/openapi.json post /v1/detection # Update detection details Source: https://docs.wirespeed.co/api-reference/detection/update-detection-details https://api.wirespeed.co/v1/openapi.json patch /v1/detection/{idOrSid} # Get directory user by ID Source: https://docs.wirespeed.co/api-reference/directory/get-directory-user-by-id https://api.wirespeed.co/v1/openapi.json get /v1/directory/{id} # Get directory user search count Source: https://docs.wirespeed.co/api-reference/directory/get-directory-user-search-count https://api.wirespeed.co/v1/openapi.json post /v1/directory/count Returns total count of directory users matching the same filters as the search endpoint. Use this for pagination totalCount without running the count in the search query. # Get directory user statistics Source: https://docs.wirespeed.co/api-reference/directory/get-directory-user-statistics https://api.wirespeed.co/v1/openapi.json get /v1/directory/stats # Get VIP user count and change Source: https://docs.wirespeed.co/api-reference/directory/get-vip-user-count-and-change https://api.wirespeed.co/v1/openapi.json get /v1/directory/vip/count # List logical directory user licenses Source: https://docs.wirespeed.co/api-reference/directory/list-logical-directory-user-licenses https://api.wirespeed.co/v1/openapi.json get /v1/directory/licenses Returns distinct provider license IDs across the current team integrations. # Search directory users Source: https://docs.wirespeed.co/api-reference/directory/search-directory-users https://api.wirespeed.co/v1/openapi.json post /v1/directory Returns one page of users. For total row count for these filters, call POST /directory/count with the same body. # Update directory user Source: https://docs.wirespeed.co/api-reference/directory/update-directory-user https://api.wirespeed.co/v1/openapi.json patch /v1/directory/{id} # Get Critical Asset count and change Source: https://docs.wirespeed.co/api-reference/endpoint/get-critical-asset-count-and-change https://api.wirespeed.co/v1/openapi.json get /v1/endpoint/hva/count Returns the current count of Critical Assets and the change over time # Get endpoint by ID Source: https://docs.wirespeed.co/api-reference/endpoint/get-endpoint-by-id https://api.wirespeed.co/v1/openapi.json get /v1/endpoint/{id} Retrieves detailed information about a specific endpoint including its public IPs and integration data # Get endpoint search count Source: https://docs.wirespeed.co/api-reference/endpoint/get-endpoint-search-count https://api.wirespeed.co/v1/openapi.json post /v1/endpoint/count Returns total count of endpoints matching the same filters as the search endpoint. Use this to get totalCount for pagination without running the count in the search query. # Search endpoints Source: https://docs.wirespeed.co/api-reference/endpoint/search-endpoints https://api.wirespeed.co/v1/openapi.json post /v1/endpoint Search and filter endpoints with pagination support. Can filter by Critical Asset status, IP, user, and managed status # Add a directory user to a group Source: https://docs.wirespeed.co/api-reference/group/add-a-directory-user-to-a-group https://api.wirespeed.co/v1/openapi.json put /v1/group/{id}/user/{userId} # Create a custom group Source: https://docs.wirespeed.co/api-reference/group/create-a-custom-group https://api.wirespeed.co/v1/openapi.json put /v1/group # Remove a directory user from a group Source: https://docs.wirespeed.co/api-reference/group/remove-a-directory-user-from-a-group https://api.wirespeed.co/v1/openapi.json delete /v1/group/{id}/user/{userId} # Search groups Source: https://docs.wirespeed.co/api-reference/group/search-groups https://api.wirespeed.co/v1/openapi.json post /v1/group # Update a group Source: https://docs.wirespeed.co/api-reference/group/update-a-group https://api.wirespeed.co/v1/openapi.json patch /v1/group/{id} # Add other integration type Source: https://docs.wirespeed.co/api-reference/integration/add-other-integration-type https://api.wirespeed.co/v1/openapi.json put /v1/integration/other # Check integration entitlements Source: https://docs.wirespeed.co/api-reference/integration/check-integration-entitlements https://api.wirespeed.co/v1/openapi.json post /v1/integration/{id}/entitlements # Delete integration Source: https://docs.wirespeed.co/api-reference/integration/delete-integration https://api.wirespeed.co/v1/openapi.json delete /v1/integration/{id} # Get all integration configurations Source: https://docs.wirespeed.co/api-reference/integration/get-all-integration-configurations https://api.wirespeed.co/v1/openapi.json get /v1/integration/config # Get integration by ID Source: https://docs.wirespeed.co/api-reference/integration/get-integration-by-id https://api.wirespeed.co/v1/openapi.json get /v1/integration/{id} # Get integration configuration by type Source: https://docs.wirespeed.co/api-reference/integration/get-integration-configuration-by-type https://api.wirespeed.co/v1/openapi.json get /v1/integration/config/{type} # Get integration health summary Source: https://docs.wirespeed.co/api-reference/integration/get-integration-health-summary https://api.wirespeed.co/v1/openapi.json get /v1/integration/health/summary Returns counts by health status (healthy, unhealthy, unstable, unknown) for the attention banner and dashboards # Get integration search count Source: https://docs.wirespeed.co/api-reference/integration/get-integration-search-count https://api.wirespeed.co/v1/openapi.json post /v1/integration/count Returns total count of integrations matching the same filters as the search endpoint. # Get OAuth installation URL Source: https://docs.wirespeed.co/api-reference/integration/get-oauth-installation-url https://api.wirespeed.co/v1/openapi.json post /v1/integration/oauth/url # Get synced licenses for integration Source: https://docs.wirespeed.co/api-reference/integration/get-synced-licenses-for-integration https://api.wirespeed.co/v1/openapi.json get /v1/integration/{id}/licenses # Search integrations Source: https://docs.wirespeed.co/api-reference/integration/search-integrations https://api.wirespeed.co/v1/openapi.json post /v1/integration # Set whether assigned directory users count toward billable users Source: https://docs.wirespeed.co/api-reference/integration/set-whether-assigned-directory-users-count-toward-billable-users https://api.wirespeed.co/v1/openapi.json patch /v1/integration/{id}/licenses/{licenseId} # Update integration Source: https://docs.wirespeed.co/api-reference/integration/update-integration https://api.wirespeed.co/v1/openapi.json patch /v1/integration/{id} # Bulk replace the current team's shared-inbox email subscriptions and settings for a notification type Source: https://docs.wirespeed.co/api-reference/notification/bulk-replace-the-current-teams-shared-inbox-email-subscriptions-and-settings-for-a-notification-type https://api.wirespeed.co/v1/openapi.json put /v1/notification/subscription/team-channel SP teams fan out each email to SELF + CLIENTS rows. When subjectLine or richNotifications are provided they are written to every affected row. # Search OCSF events Source: https://docs.wirespeed.co/api-reference/ocsf/search-ocsf-events https://api.wirespeed.co/v1/openapi.json post /v1/ocsf/advanced # Cases over time Source: https://docs.wirespeed.co/api-reference/team/cases-over-time https://api.wirespeed.co/v1/openapi.json post /v1/team/statistics/cases-over-time # Create a new team Source: https://docs.wirespeed.co/api-reference/team/create-a-new-team https://api.wirespeed.co/v1/openapi.json put /v1/team # Create a team-level API key Source: https://docs.wirespeed.co/api-reference/team/create-a-team-level-api-key https://api.wirespeed.co/v1/openapi.json put /v1/team/api-keys # Delete a team-level API key Source: https://docs.wirespeed.co/api-reference/team/delete-a-team-level-api-key https://api.wirespeed.co/v1/openapi.json delete /v1/team/api-keys/{apiKeyId} # Delete the current team and all associated data Source: https://docs.wirespeed.co/api-reference/team/delete-the-current-team-and-all-associated-data https://api.wirespeed.co/v1/openapi.json delete /v1/team Teams with child teams (rows with parent_team_id pointing at this team) cannot be deleted. Empty service providers with no child teams may be deleted. # Detections created over time Source: https://docs.wirespeed.co/api-reference/team/detections-created-over-time https://api.wirespeed.co/v1/openapi.json post /v1/team/statistics/detections-over-time # Get all team-level API keys Source: https://docs.wirespeed.co/api-reference/team/get-all-team-level-api-keys https://api.wirespeed.co/v1/openapi.json get /v1/team/api-keys # Get all teams with slim payload Source: https://docs.wirespeed.co/api-reference/team/get-all-teams-with-slim-payload https://api.wirespeed.co/v1/openapi.json get /v1/team/all-slim # Get current team information Source: https://docs.wirespeed.co/api-reference/team/get-current-team-information https://api.wirespeed.co/v1/openapi.json get /v1/team # Get team billable resource statistics Source: https://docs.wirespeed.co/api-reference/team/get-team-billable-resource-statistics https://api.wirespeed.co/v1/openapi.json post /v1/team/statistics/resources # Get team detection statistics Source: https://docs.wirespeed.co/api-reference/team/get-team-detection-statistics https://api.wirespeed.co/v1/openapi.json post /v1/team/statistics/detections # Get team event statistics by integration Source: https://docs.wirespeed.co/api-reference/team/get-team-event-statistics-by-integration https://api.wirespeed.co/v1/openapi.json post /v1/team/statistics/events # Get team member search count Source: https://docs.wirespeed.co/api-reference/team/get-team-member-search-count https://api.wirespeed.co/v1/openapi.json post /v1/team/users/count # Invite user to team Source: https://docs.wirespeed.co/api-reference/team/invite-user-to-team https://api.wirespeed.co/v1/openapi.json put /v1/team/invite # Noise reduction rate over time Source: https://docs.wirespeed.co/api-reference/team/noise-reduction-rate-over-time https://api.wirespeed.co/v1/openapi.json post /v1/team/statistics/noise-reduction-over-time # Remove external user from team Source: https://docs.wirespeed.co/api-reference/team/remove-external-user-from-team https://api.wirespeed.co/v1/openapi.json delete /v1/team/users/{userId} # Search service provider teams Source: https://docs.wirespeed.co/api-reference/team/search-service-provider-teams https://api.wirespeed.co/v1/openapi.json post /v1/team # Search system logs Source: https://docs.wirespeed.co/api-reference/team/search-system-logs https://api.wirespeed.co/v1/openapi.json post /v1/team/log # Search team members Source: https://docs.wirespeed.co/api-reference/team/search-team-members https://api.wirespeed.co/v1/openapi.json post /v1/team/users # Switch to a different team Source: https://docs.wirespeed.co/api-reference/team/switch-to-a-different-team https://api.wirespeed.co/v1/openapi.json post /v1/team/switch # Update team information Source: https://docs.wirespeed.co/api-reference/team/update-team-information https://api.wirespeed.co/v1/openapi.json patch /v1/team # Create a comment with optional image attachments Source: https://docs.wirespeed.co/api-reference/timeline/create-a-comment-with-optional-image-attachments https://api.wirespeed.co/v1/openapi.json post /v1/timeline/comments # Edit comment text and optionally replace attachments Source: https://docs.wirespeed.co/api-reference/timeline/edit-comment-text-and-optionally-replace-attachments https://api.wirespeed.co/v1/openapi.json patch /v1/timeline/comments/{id} # List comments for an entity Source: https://docs.wirespeed.co/api-reference/timeline/list-comments-for-an-entity https://api.wirespeed.co/v1/openapi.json get /v1/timeline/comments # Merged timeline of comments, logs, and activity for an entity Source: https://docs.wirespeed.co/api-reference/timeline/merged-timeline-of-comments-logs-and-activity-for-an-entity https://api.wirespeed.co/v1/openapi.json get /v1/timeline # Soft-delete a comment Source: https://docs.wirespeed.co/api-reference/timeline/soft-delete-a-comment https://api.wirespeed.co/v1/openapi.json delete /v1/timeline/comments/{id} # Get current user information Source: https://docs.wirespeed.co/api-reference/users/get-current-user-information https://api.wirespeed.co/v1/openapi.json get /v1/users # Update user role Source: https://docs.wirespeed.co/api-reference/users/update-user-role https://api.wirespeed.co/v1/openapi.json patch /v1/users/{id}/role # Get all verdict rules Source: https://docs.wirespeed.co/api-reference/verdict/get-all-verdict-rules https://api.wirespeed.co/v1/openapi.json get /verdict/rules # Billable Assets Source: https://docs.wirespeed.co/assets/billable-assets How Wirespeed calculates billable users and endpoints Wirespeed bills on users and endpoints. Billable users are distinct directory identities assigned to licenses marked **Billable**. Billable endpoints are eligible synced assets. View billable counts under **Settings > Team Analytics** in the **Billable Resources** section. Service providers also see per-client columns on the **Clients** page. Mark licenses as billable on each identity integration's **Licenses** list. ## Billable users A person counts once, even when they hold several billable licenses or appear in more than one identity integration. Wirespeed uses canonical identity clustering so the same person is not double-counted. Operators choose which licenses count: toggle **Billable** on the integration **Licenses** list. The SKUs below start as billable. These are initial defaults. Operators can change supported license selections with the **Billable** toggle. A user appears under the Users table's **Billable** filter only when Wirespeed has a per-user assignment to a license currently marked Billable, and the identity is managed, enabled, and not in an enabled NHI group. Google Workspace connections that have granted license-management access use per-user license assignments. Connections without assignment data count managed, enabled directory users, excluding NHI and External identities. ### Microsoft Names match Microsoft's [product names and service plan identifiers](https://learn.microsoft.com/en-us/entra/identity/users/licensing-service-plan-reference). Unknown subscribed SKUs start as not billable. * Enterprise Mobility + Security A3 for Faculty * Enterprise Mobility + Security E3 * Enterprise Mobility + Security E5 * Enterprise Mobility + Security E5\_USGOV\_GCCHIGH * Enterprise Mobility + Security G3 GCC * Enterprise Mobility + Security G5 GCC * Intune * Intune for Education * Microsoft 365 A1 * Microsoft 365 A3 - Unattended License for students use benefit * Microsoft 365 A3 for Faculty * Microsoft 365 A3 for Students * Microsoft 365 A3 for students use benefit * Microsoft 365 A5 for faculty * Microsoft 365 A5 for Students * Microsoft 365 A5 for students use benefit * Microsoft 365 A5 without Audio Conferencing for students use benefit * Microsoft 365 Apps for Business * Microsoft 365 Apps for Enterprise * Microsoft 365 Apps for Faculty * Microsoft 365 Apps for Students * Microsoft 365 Business Basic * Microsoft 365 Business Basic (no Teams) * Microsoft 365 Business Basic EEA (no Teams) * Microsoft 365 Business Premium * Microsoft 365 Business Premium (no Teams) * Microsoft 365 Business Premium Donation * Microsoft 365 Business Premium EEA (no Teams) * Microsoft 365 Business Standard * Microsoft 365 Business Standard (no Teams) * Microsoft 365 Business Standard - Prepaid Legacy * Microsoft 365 Business Standard EEA (no Teams) * Microsoft 365 E3 * Microsoft 365 E3 (500 seats min)\_HUB * Microsoft 365 E3 (no Teams) * Microsoft 365 E3 - Unattended License * Microsoft 365 E3 EEA (no Teams) * Microsoft 365 E3 EEA (no Teams) (500 seats min)\_HUB * Microsoft 365 E3 EEA (no Teams) - Unattended License * Microsoft 365 E3\_USGOV\_DOD * Microsoft 365 E3\_USGOV\_GCCHIGH * Microsoft 365 E5 * Microsoft 365 E5 (500 seats min)\_HUB * Microsoft 365 E5 (no Teams) * Microsoft 365 E5 Developer (without Windows and Audio Conferencing) * Microsoft 365 E5 EEA (no Teams) * Microsoft 365 E5 EEA (no Teams) (500 seats min)\_HUB * Microsoft 365 E5 EEA (no Teams) with Calling Minutes * Microsoft 365 E5 EEA (no Teams) without Audio Conferencing * Microsoft 365 E5 EEA (no Teams) without Audio Conferencing (500 seats min)\_HUB * Microsoft 365 E5 Security * Microsoft 365 E5 Security for EMS E5 * Microsoft 365 E5 with Calling Minutes * Microsoft 365 E5 without Audio Conferencing * Microsoft 365 E5 without Audio Conferencing (500 seats min)\_HUB * Microsoft 365 E5\_USGOV\_GCCHIGH * Microsoft 365 F1 * Microsoft 365 F1 EEA (no Teams) * Microsoft 365 F3 * Microsoft 365 F3 EEA (no Teams) * Microsoft 365 F3 GCC * Microsoft 365 F5 Security + Compliance Add-on * Microsoft 365 F5 Security Add-on * Microsoft 365 G3 - Unattended License for GCC * Microsoft 365 G3 GCC * Microsoft 365 GCC G5 * Microsoft 365 GCC G5 w/o WDATP/CAS Unified * Microsoft 365 Security and Compliance for Firstline Workers * Microsoft Defender for Endpoint * Microsoft Defender for Endpoint F2 * Microsoft Defender for Endpoint P2\_XPLAT * Microsoft Defender for Endpoint Server * Microsoft Entra ID P1 * Microsoft Entra ID P1 for Faculty * Microsoft Entra ID P1\_USGOV\_GCCHIGH * Microsoft Entra ID P2 * Microsoft Intune Device * Microsoft Intune Device for Government * Microsoft Intune Government * Microsoft Intune Plan 1 A VL * Microsoft Intune Plan 1 A VL\_USGOV\_GCCHIGH * Microsoft Intune SMB * Microsoft Intune Suite * Microsoft Teams Exploratory * Microsoft Teams Exploratory Dept * Microsoft Teams Rooms Pro * Microsoft Teams Rooms Pro for EDU * Microsoft Teams Rooms Pro for GCC * Microsoft Teams Rooms Pro without Audio Conferencing * Microsoft Teams Rooms Standard * Microsoft Teams Rooms Standard for GCC * Microsoft Teams Rooms Standard for GCC without Audio Conferencing * Microsoft Teams Rooms Standard without Audio Conferencing * Microsoft Teams Shared Devices * Microsoft Teams Shared Devices for Faculty * Microsoft Teams Shared Devices for GCC * Office 365 A1 for faculty * Office 365 A1 for students * Office 365 A1 Plus for faculty * Office 365 A1 Plus for students * Office 365 A3 for faculty * Office 365 A3 for students * Office 365 A5 for faculty * Office 365 A5 for students * Office 365 E1 * Office 365 E1 (no Teams) * Office 365 E1 EEA (no Teams) * Office 365 E1\_USGOV\_GCCHIGH * Office 365 E3 * Office 365 E3 (no Teams) * Office 365 E3 Developer * Office 365 E3 EEA (no Teams) * Office 365 E3\_USGOV\_DOD * Office 365 E3\_USGOV\_GCCHIGH * Office 365 E4 * Office 365 E5 * Office 365 E5 EEA (no Teams) * Office 365 E5 EEA (no Teams) without Audio Conferencing * Office 365 E5 Without Audio Conferencing * Office 365 F3 * Office 365 F3 EEA (no Teams) * Office 365 F3\_USGOV\_GCCHIGH * Office 365 Midsize Business * Teams Rooms Premium * Windows 10/11 Enterprise A5 for faculty * Windows 10/11 Enterprise E5 * Windows 10/11 Enterprise E5 (Original) * Windows 10/11 Enterprise E5 Commercial (GCC Compatible) ### Google Workspace Names match Google's [Licensing API product and SKU catalog](https://developers.google.com/workspace/admin/licensing/v1/how-tos/products). Unknown Google-Apps SKUs also start as billable. Add-ons such as Vault, Voice, Gemini, Cloud Identity, Drive storage, and archived-user SKUs start as not billable. * G Suite Basic * G Suite Business * G Suite Legacy * G Suite Lite * Google Workspace Business Continuity * Google Workspace Business Continuity Plus * Google Workspace Business Plus * Google Workspace Business Standard * Google Workspace Business Starter * Google Workspace Education * Google Workspace Enterprise Essentials * Google Workspace Enterprise Essentials Plus * Google Workspace Enterprise Plus * Google Workspace Enterprise Standard * Google Workspace Enterprise Starter * Google Workspace Essentials * Google Workspace Frontline Plus * Google Workspace Frontline Standard * Google Workspace Frontline Starter * Google Workspace Government * Google Workspace for Education Fundamentals * Google Workspace for Education Gmail Only * Google Workspace for Education Plus * Google Workspace for Education Plus - Legacy * Google Workspace for Education Plus (Staff) * Google Workspace for Education Standard * Google Workspace for Education Standard (Staff) ## Billable endpoints Billable endpoints are live, managed endpoints from endpoint management or EDR integrations, excluding **Mobile** endpoints. Detection-only endpoints are not billable. ## Service providers The **Clients** page shows **Billable Users** and **Billable Endpoints** per client. Totals aggregate the clients in the current view. If billable totals look wrong after integrations have synced, confirm the intended SKUs are marked Billable, then contact support and provide the expected number of billable users. # Endpoints Source: https://docs.wirespeed.co/assets/endpoints All endpoints available in your detection integrations are ingested into Wirespeed and correlated across cases. This allows you to identify repeat offenders over time, add special handling for critical assets, and provide Wirespeed more context for case triaging. ## Related users Wirespeed does not provide a manual control to pick which user is assigned to an endpoint. User–endpoint associations are created automatically when your endpoint management, EDR, or MDM integrations sync device inventory and include which directory user belongs to each device (for example primary or last-logged-on user). Those users must already exist in Wirespeed from your [directory integrations](/assets/users); the user identifiers from the endpoint source need to match the users synced from your directory. If Related users is empty for many endpoints, check that your directory and device integrations are connected and syncing, and that your vendors expose user–device mapping to Wirespeed. Some systems (for example servers or shared devices) may not report a single assigned user. If you expect mappings and still see none, contact support with your integration types. ## Endpoint Exclusions You can exclude endpoints that are frequently flagged as malicious but are intended for legitimate use. See Exclusions for more information. ## Server vs. Workstation We automatically classify endpoints as either "Server" or "Workstation" based on the operating system. This is done to help with triaging and automation rules. This is not currently configurable, if you would like to change the classification for an endpoint please contact support. ## Critical Assets Critical assets are part of our Detection Integrations and allow us to automatically identify systems of importance within your organization. These would commonly be systems with special organizational or technological privileges such that when a detection is ingested in relation to them should get special handling. ## Critical Asset Automations You can configure custom critical asset identification rules underneath Assets > Endpoints. Create a search query that identifies the critical assets you want and click "Create Critical Asset Automation". Any new or existing assets matching that query will be automatically marked as a Critical Asset. ## Remediation More information about endpoint remediation can be found here. ## Billable endpoints Billable endpoint counts prefer license data when available; otherwise they fall back to live, managed endpoints synced from integrations excluding Mobile group members. See [Billable Assets](/assets/billable-assets) for how counts are calculated. # Files Source: https://docs.wirespeed.co/assets/files Files from your detection integrations are analyzed to determine their nature—malicious or benign. Detection of malicious files considers factors such as the targeted endpoint or user, exclusion status, and findings from our threat intelligence sources. ## File Exclusions You can exclude files that are frequently flagged as malicious but are intended for legitimate use. See Exclusions for more information. ## Metadata Tools have the following metadata available on them that alter how they are handled: | Name | Description | | - | - | | Late stage tool | Associated with tools that are common in the later stages of a breach | | Malware | Tools that are commonly used in breaches | | Benign | Known safe for use | | Ransomware | Encrypts files and demands payment for decryption | | Unknown | None of the above categories are true | Unknown file risk means Wirespeed did not assign another label (malware, benign, live-off-the-land, etc.) from the file and threat data it had. That is not a determination that the file is safe or malicious. # IPs Source: https://docs.wirespeed.co/assets/ips IP addresses are ingested from alerts on your detection integrations that have been previously identified by your detections vendor. Some may be benign and others may be malicious. Malicious IP addresses are determined by their usage of privacy-protecting services like Tor or VPNs and their countries of origin. IP address information is provided for free with our IPInfo integration. ## IP Exclusions You can exclude IPs that are frequently flagged as malicious but are intended for legitimate use. See Exclusions for more information. # Locations Source: https://docs.wirespeed.co/assets/locations A variety of alerts from your detection integrations include location information, usually related to the location of the asset or user triggering alerts. You may view all identified locations underneath Assets > Locations and investigate cases Wirespeed has triaged from each location. ## Location Exclusions You can exclude Locations that are frequently flagged as malicious but are intended for legitimate use. See Exclusions for more information. ​ # Processes Source: https://docs.wirespeed.co/assets/processes Process information is taken from your detection integrations when malicious commands are identified on your endpoints. Process information includes things like the command that was run, the SHA1 and SHA256 of the command, and any threat intelligence we are able to gather related to the process. ## Process Exclusions You can exclude Processes that are frequently flagged as malicious but are intended for legitimate use. See Exclusions for more information. # Users Source: https://docs.wirespeed.co/assets/users Users are ingested from your directory integrations and enable ChatOps, VIP identification, and technical user identification. ## User Exclusions You can exclude Users that are frequently flagged as malicious but are intended for legitimate use. See Exclusions for more information. ## Breach Data Breach data for your users is included by default with our Have I Been Pwned integration. ## VIPs Very Important Persons (VIPs) are part of our directory integrations and allow us to automatically identify people of importance within your organization. These would commonly be people with special organizational or technological privileges such that when a detection is ingested in relation to them should get special handling. ### VIP Automations You can configure custom VIP identification rules underneath Assets > Users. Create a search query that identifies the VIPs you want and click "Create VIP Automation". Any new or existing users matching that query will be automatically marked as a VIP. ## Technical Users Technical users are part of our directory integrations and allow us to automatically identify people that commonly perform technical operations within your organization. These would be people that interact with the command line, download tools, or do other IT/engineering tasks regularly. Understanding these users helps us decide when to escalate suspicious commands on their endpoints. ### Technical User Automations You can configure custom technical user identification rules underneath Assets > Users. Create a search query that identifies the users you want and click Actions > Create Technical User Automation. Any new or existing users matching that query will be automatically marked as technical. ## Administrative Users Administrative users are part of our directory integrations and allow us to automatically identify people that commonly perform administrative operations within your organization. These would be people that are considered System Administrators, Global Admins, or anyone else that has privileged access in your organization.Any user marked as an administrator will be automatically marked as technical. ### Administrative User Automations You can configure custom administrative user identification rules underneath Assets > Users. Create a search query that identifies the users you want and click Actions > Create Administrative User Automation. Any new or existing users matching that query will be automatically marked as administrative. ## External Users External users are part of our directory integrations and allow us to identify contractors, vendors, or other identities outside your core organization. Wirespeed uses this when verdicting detections—for example, logins from an external user on a privacy VPN may be auto-closed by default to reduce noise. To alert on those logins instead, disable that rule under Settings > Verdicts > Identity > Login. ### External User Automations You can configure custom external user identification rules underneath Assets > Users. Create a search query that identifies the users you want and click Actions > Create External User Automation. Any new or existing users matching that query will be automatically marked as external. ## Remediation More information on remediation can be found here. ## Group Syncing Wirespeed allows you to create automation rules, chat ops settings, and more based on the group a user is assigned to. However, group membership is not synced by default due to limitations in source systems. To sync all group memberships for a specific group select "Manage Group Sync" on the Users page, search for the correct group(s), select the 3-dots on their row and select Enable Sync. ## User-endpoint links User–endpoint links are not set manually in Wirespeed; they come from synced directory and EDR/MDM data. See [Endpoints — Related users](/assets/endpoints#related-users) if endpoints show no assigned users. ## Billable users Billable user counts prefer license data from Microsoft or Google Workspace when available; otherwise they fall back to enabled, managed directory users excluding NHI and External group members. See [Billable Assets](/assets/billable-assets) for how counts are calculated. # Communication Plan Source: https://docs.wirespeed.co/chat-ops/communication-plan Introduce your company to chat operations It's a great idea to be sensitive to deploying anything that communicates with your workforce about security issues to avoid confusion or concern that Wirespeed ChatOps is unsafe and actually a bad guy. Here are some options that you have to do this: ## Onboarding Group Underneath the chat ops settings, you can enable an onboarding group. This will allow you to select what users you want to receive chat ops messages. We will only interact with these users while you are in the onboarding phase. You can search for users in bulk and select the add or remove buttons at the bottom of the dialog to add all matches, or select the 3-dot menu on each user to add or remove them. ## SMS Chat Ops All Wirespeed SMS communications will come from `+1 (855) 627-0635` You can choose to send chat ops via SMS to increase responsiveness from your users. Due to FCC regulations every user in your organization must explicitly consent to receive SMS messages before we can message them. ### How SMS Enrollment Works After you enable SMS chat ops, Wirespeed automatically sends enrollment emails to eligible users: 1. **Invite emails** are sent to users inviting them to enroll in SMS notifications 2. **Up to 3 attempts** are made per user, with invites sent weekly 3. **Users who don't respond** after 3 attempts are marked as "Max Attempts" and will not receive further invites ### Who Receives Invites * Only users with **authentication activity in the last 30 days** are invited * If you have an [onboarding group](#onboarding-group) enabled, only users in that group are invited * New eligible users are identified and automatically invited **once a week** Before enabling SMS we suggest sending a [preemptive rollout message](#preemptive-rollout-messaging) so users expect the email and know it is not phishing. ### SMS Enrollment Status You can view each user's SMS enrollment status on their detail page under **Assets > Users**. The status shows: | Status | Meaning | | - | - | | **Enrolled** | User has consented to receive SMS messages | | **Pending (X/3)** | Invite sent, awaiting response (shows attempt count) | | **Max Attempts** | 3 invites sent without response | | **Opted Out** | User declined SMS enrollment | | **Not Invited** | No invite has been sent yet | ### Resetting SMS Invites Wirespeed does not offer a general "re-send enrollment invite" action for every user. Automatic invites are sent weekly (up to 3 attempts). If a user still has pending invites—for example, status **Pending (1/3)** or **Pending (2/3)**—wait for the next automatic invite or ask the user to check their inbox for the most recent enrollment email. If a user reaches **Max Attempts** (3 invites sent with no response) and later wants to enroll, an administrator can reset their invite: 1. Navigate to **Assets > Users** and select the user 2. Confirm their SMS enrollment status is **Max Attempts** 3. Open the **Actions** dropdown menu 4. Select **Reset SMS Invite** **Reset SMS Invite** only appears in **Actions** when all of the following are true: * The user's status is **Max Attempts** (3 enrollment emails sent without a response) * The user has **not** completed SMS enrollment * The user has **not** opted out of SMS enrollment If you do not see this action, check the user's SMS enrollment status on their profile. Users who are still pending, already enrolled, or opted out will not show this option. Resetting clears the attempt counter and immediately sends a new enrollment email. ## On First Use Messages Enabled by default, the "On First Use" messages give a short explanation about what Wirespeed is, like this: > Wirespeed is an application that keeps your company safe from hackers by occasionally asking you questions about you and your coworker's activities. You can learn more about us here [https://wirespeed.co](https://wirespeed.co) and ask your security team for more information. You may disable this message by selecting the Trash icon next to the text field. ## Account Locked Messages When a user's account is locked in response to an actionable detection, they will receive a message like this: > Suspicious activity has been detected for your account which has caused us to reset your password and log you out of all active sessions. To regain access, please follow your company's password reset instructions. This message is required but may be customized underneath Settings > Chat Ops. It is recommended to add a link to your password reset instructions. ## Initial Rate Limiting It's best to rollout new functionality in stages to minimize any issues or confusion. Wirespeed allows you to set a limit on the number of chat ops interactions per day, so you can introduce it in small chunks to your organization. Escalation emails are handled separately through notification subscriptions and team inbox settings. ## Preemptive Rollout Messaging It's also a good idea to send an organization-wide message about rolling out Wirespeed, using the normal communication channels they would expect to see important updates, such as an organization-wide chat channel or official email address responsible for security or tech changes.​ Here's an example template you could start from: > Hi Team, > > This is a quick note to let you know that we have started using a cybersecurity monitoring app called Wirespeed which will occasionally message you asking you questions about your online activity, such as logging in from unusual locations. To the best of your ability, please answer any questions from the app so we can all make sure to keep our organization safe from hackers and ransomware. Wirespeed's goal is to be painless and only ask you when it matters. > > Please also note that Wirespeed will never ask you for sensitive information, like your password, bank account, or government ID numbers! > > A screenshot of an example Wirespeed message is below. > > Thanks and please let us know if you have any questions! > > \- Security Team ## Examples Below are examples of what the user will receive in Slack, Microsoft Teams, Email, and SMS. ### Initial Message We will initially message the user through all available communication channels. Email, Slack, Teams, and SMS will redirect them to our website and go through the [chat ops steps](#chat-ops-steps). Microsoft Teams will stay in app and display the chat ops steps in an iframe. ### Chat Ops Steps The user will receive a message with a brief summary of the security alert. If they select no, their account and endpoint will be locked, and they will be told to contact their IT department to unlock it. If they select yes, they will continue to step 2. If the user says they performed the action, we will send them an MFA token to verify their identity. The user will receive a text message with a six-digit short code. The user will enter the code into the text field and click **Verify Code**. The case will automatically be closed and the users responses will be saved. ## Service Provider ChatOps Wirespeed allows you as a Service Provider to configure default Welcome, Subject Line, Message Signature, and Account Locked messaging for all of your client teams. Within your parent client, navigate to ChatOps and input the default values that you want. When you spin a client team, they will inherit these fields. They can override these fields at any time and can also reset to your original default should they wish to. Should you update the field in your parent team, all client teams that have not overriden your messaging will inherit your latest messaging. *** ## FAQ No. Due to FCC regulations, each user must provide their own phone number and give explicit consent to receive SMS messages. Administrators cannot manually add phone numbers on behalf of users. The user must complete the SMS enrollment process themselves by clicking the link in their enrollment email and entering their phone number. Users must have **authentication activity in the last 30 days** to receive an SMS enrollment invite. If you have an onboarding group enabled, the user must also be in that group. New eligible users are automatically identified and invited once a week. Check the user's SMS enrollment status under **Assets > Users** to see their current status. Wirespeed sends up to **3 enrollment invites** per user, with invites sent weekly. After 3 attempts without a response, the user is marked as **Max Attempts** and will not receive further automatic invites. If they later want to enroll, use **Reset SMS Invite** from the user's **Actions** menu (see [Resetting SMS Invites](#resetting-sms-invites)). Only in limited cases. There is no general re-send action for users who are still pending (**Pending (1/3)** or **Pending (2/3)**)—those users continue to receive automatic weekly invites until they respond or reach 3 attempts. If a user's status is **Max Attempts**, an administrator can use **Reset SMS Invite** under **Assets > Users > \[user] > Actions**. That option appears only when the user has hit the 3-attempt limit, has not enrolled, and has not opted out. It resets the counter and sends a new enrollment email immediately. You cannot manually re-send invites to users who have already enrolled or who have opted out. All Wirespeed SMS communications are sent from `+1 (855) 627-0635`. You may want to share this with your team when rolling out SMS chat ops so they recognize the number. Yes. Users can opt out of SMS during enrollment or after enrolling. Their status changes to **Opted Out** and they stop receiving SMS messages. **Reset SMS Invite** is not available for opted-out users. If someone who opted out later wants SMS Chat Ops, contact Wirespeed support for help re-enrolling them. During a chat ops investigation, if a user indicates they don't have access to their phone for MFA verification, Wirespeed discards the unverified response and resolves the detection using the rule's configured timeout verdict. # Introduction to Chat Ops Source: https://docs.wirespeed.co/chat-ops/introduction What is it and how to get started Chat operations (ChatOps) are how Wirespeed investigates cases involving users from your company. We interact with them over your collaboration platforms to investigate and question them about suspicious activities. ## Escalations By default, all chat ops have a delay time of 10 minutes. If the user has not responded in that window, Wirespeed continues using the rule's configured timeout outcome. You can modify the escalation delay under **Settings > Chat Ops**. ## Security Team Notifications Security team alerts are delivered through standard notifications and team inbox email escalations instead of a chat ops conversation. Configure: * user notification subscriptions in your profile ([Notifications](/settings/notifications)) * team escalation inboxes under **Settings > Team** ## Multi-factor Verification After a chat ops message is sent you can optionally require the user to verify their identity over SMS. This helps protect your organization in cases where the user's account has already been compromised. When this setting is enabled, the user will be texted an SMS code to verify their identity after they respond to our chat ops message. If no mobile phone number is identified for the user, their response cannot be verified and the detection continues using the rule's configured timeout outcome. *** ## FAQ If a user doesn't respond within the escalation delay (default: 10 minutes), the detection proceeds with a suspicious verdict (or your configured timeout verdict). Yes. Navigate to **Settings > Chat Ops** to modify the escalation delay time. Timeout outcomes are configured in the relevant verdict rule under **Settings > Verdicts**. Wirespeed can send chat ops messages via Email, Slack, Microsoft Teams, and SMS. We initially message users through all available communication channels to maximize response rates. If SMS MFA verification is enabled, users must verify their identity with a code sent to their phone after responding to a chat ops message. This helps ensure a compromised account cannot falsely claim activity is legitimate. If no phone number is available, the unverified response is discarded and the detection proceeds with your configured timeout verdict. # I received a message from Wirespeed Source: https://docs.wirespeed.co/chat-ops/received-message What should I do now? [Wirespeed](https://wirespeed.co/) is a Managed Detection and Response (MDR) company that investigates alerts within your organization. If you have received a message from us that is because we detected a suspicious activity in relation to your account. This usually means a suspicious login from a new location or potentially malicious commands executed on your computer. ## **I did not perform this action** If you do not believe you performed these activities, select "No" on the chat message and we will automatically remediate the appropriate resources. This may include locking out your account until your password can be reset. Proceed with **next steps** once you have responded to the message. ## **I performed this action** If you did perform these activities, selecting "Yes" will ignore the case and help us learn more so we don't message you again for similar activities. ## **I don't know what this means** If you are unsure what this means, it is safe to assume you did not perform the activity and should select "No" to begin remediating the problematic resources. Proceed with **next steps** once you have done so. ## **Next Steps** If your account is locked out, please contact your IT department to begin a password reset. If you have any questions, please contact [support@wirespeed.co](mailto:support@wirespeed.co) or your IT department for more information. # Advanced Queries Source: https://docs.wirespeed.co/events/advanced-queries Advanced queries and filtering Use [ClickHouse](https://clickhouse.com/) SQL to investigate the normalized SIEM data produced by your integrations. Wirespeed stores common event fields in typed `wspd_*` tables and retains the original vendor payload in its source-specific `*_logs` table. Start with a normalized table for cross-source investigations, then query the source table named in `_wspd_table` when you need vendor-specific fields. ## Quick Start To run an advanced query, navigate to the **Events** page and select the icon in the top right. Select **Ask Wirespeed** beside the SQL editor to start the **Create Advanced Query** workflow. Ask Wirespeed inspects your connected tables, verifies the selected fields, runs a bounded representative query, validates the final SQL, and returns an **Execute** button that opens the query in Advanced Events. ## Schema Always bound event queries with `_wspd_time`. The Advanced page supplies `{startTime: DateTime64}` and `{endTime: DateTime64}` from its timeframe selector. ### Tables * `wspd_events` — consolidated event index across connected log sources * `wspd_authentication_events` — normalized login and authentication activity * `wspd_productivity_events` — normalized email, file, and collaboration activity * `wspd_dns_events` — normalized DNS activity * `*_logs` — source-specific raw log tables, such as `microsoft_entra_signin_logs` The consolidated `wspd_events` table includes: | Column | Description | | - | - | | `_wspd_id` | Event identifier | | `_wspd_team_id` | Owning team; automatically scoped by row-level security | | `_wspd_integration_id` | Source integration identifier | | `_wspd_integration_slug` | Source integration type | | `_wspd_table` | Source table containing the vendor payload | | `_wspd_event_type` | Normalized event type | | `_wspd_time` | Event timestamp in UTC | | `_wspd_ingested_at` | Time Wirespeed stored the event | | `_wspd_observables` | Normalized searchable values | | Column | Description | | - | - | | `status` | Authentication result, including `SUCCESS` and `FAILURE` | | `is_mfa` | Whether the event involved MFA | | `actor_email` | Authenticating user's email | | `actor_username` | Authenticating username | | `src_ip` | Source IP address | | `src_ip_country` | Enriched source country | | `src_ip_asn_number` | Enriched source ASN | | `src_ip_asn_name` | Enriched source network name | | `src_ip_vpn` | VPN indicator | | `src_ip_proxy` | Proxy indicator | | `src_ip_tor` | Tor indicator | | `src_ip_relay` | Relay indicator | | `user_agent` | Source user agent | | `session_uid` | Authentication session identifier | ### Examples ```sql theme={null} SELECT _wspd_event_type, count(*) AS event_count FROM wspd_events WHERE _wspd_time >= {startTime: DateTime64} AND _wspd_time < {endTime: DateTime64} GROUP BY _wspd_event_type ORDER BY event_count DESC; ``` ```sql theme={null} SELECT _wspd_time, actor_email, src_ip, src_ip_country, user_agent, message FROM wspd_authentication_events WHERE status = 'FAILURE' AND _wspd_time >= {startTime: DateTime64} AND _wspd_time < {endTime: DateTime64} ORDER BY _wspd_time DESC LIMIT 100; ``` ```sql theme={null} WITH historical_locations AS ( SELECT DISTINCT lower(actor_email) AS actor_email, upper(src_ip_country) AS country FROM wspd_authentication_events WHERE status = 'SUCCESS' AND src_ip_country != '' AND _wspd_time >= toDateTime({startTime: DateTime64}) - INTERVAL 30 DAY AND _wspd_time < {startTime: DateTime64} ) SELECT current._wspd_time, current.actor_email, current.src_ip, current.src_ip_country, current.user_agent FROM wspd_authentication_events AS current WHERE current.status = 'SUCCESS' AND current.src_ip_country != '' AND current._wspd_time >= {startTime: DateTime64} AND current._wspd_time < {endTime: DateTime64} AND (lower(current.actor_email), upper(current.src_ip_country)) NOT IN ( SELECT actor_email, country FROM historical_locations ) ORDER BY current._wspd_time DESC LIMIT 100; ``` ### Null values Most normalized fields use non-nullable types. Missing strings are represented by `''`, while missing numeric values use the column's default. ### Timestamps All timestamps are stored and presented in UTC. ## Resource limits * **2000** rows per interactive query * **4GB** of memory per query * **60s** of execution time per query [Custom detections](/events/custom-detections) are created and verified in Ask Wirespeed with a limit of fewer than 100 matches in the last hour and a 7.5-second execution ceiling. # Off-Platform Detections Source: https://docs.wirespeed.co/events/automated-custom-edr-detections Review detection rules imported from connected EDR, XDR, and SIEM providers ## Overview Wirespeed imports custom detection rules from supported security platforms. You can review and categorize these rules in one place. When an imported rule fires, Wirespeed applies its category and starts the standard detection workflow. ## How It Works 1. **Automatic Sync**: Wirespeed periodically syncs custom detection rules from connected EDR, XDR, and SIEM providers. 2. **AI Classification**: Wirespeed AI suggests a detection category from the rule content and behavior. 3. **Rule Review**: You can review the rule, change its category, and configure Always Notify. 4. **Automatic Matching**: When the rule fires in the provider, Wirespeed matches the alert to the imported rule and applies its category. ## Supported Integrations The following integrations support automatic custom detection import: * **CrowdStrike**: Imports custom Indicator of Attack (IOA) rules * **Google Chronicle**: Imports custom detection rules * **Microsoft Defender**: Imports custom detection rules from Microsoft 365 Defender and Microsoft Sentinel * **Palo Alto Cortex**: Imports custom detection rules * **SentinelOne**: Imports custom detection rules More integrations are being added regularly. Check your integration's documentation page for the latest capabilities. ## Manage Off-Platform Detections Go to **Settings > Detection Rules > Off-Platform Detections** to review rules synced from your integrations. ### View Imported Rules The **Off-Platform Detections** tab shows the rules imported from your providers: * View detection name, description, and severity * See which integration each rule comes from * Check whether the rule is enabled in the provider * Review the selected and AI-suggested categories ### Review Rules Open a rule to review its details and sample detection. You can use the AI-suggested category or select a different category. Wirespeed AI suggests a category from the rule's indicators, behaviors, and threat patterns. Select a different category if the suggestion does not match your workflow. ### Rule Details When reviewing or editing an imported rule, you can view: * **Detection Information**: Name, description, severity, and source payload * **Categorization**: Selected category and AI suggestion (if available) * **Sample Detection**: An example of what this rule detects (when available from the provider) * **Provider Metadata**: Additional context from your security platform * **Raw Payload**: Full JSON structure of the rule as received from the integration ### Provider Status and Always Notify * **Enabled in Provider**: Shows whether the rule is enabled in the source platform. This value is read-only in Wirespeed. * **Always Notify**: Keeps detections from this rule open for review, regardless of the normal verdict result. To enable or disable a rule, use the source provider. Wirespeed does not change this provider setting. ## Detection Matching When a detection is received from an integrated platform: 1. Wirespeed checks if it matches an imported custom detection rule 2. Wirespeed uses a match when the provider rule is enabled and has a selected or AI-suggested category 3. Wirespeed applies the category and starts the normal [verdicting](/verdicts/introduction) and case creation workflow 4. The detection timeline logs show that it was matched to an imported rule Wirespeed matches rules by integration and provider rule ID. Deleted rules and rules disabled in the provider do not match. ## Best Practices 1. **Review Regularly**: Check for rules that were recently synced from your security platforms. 2. **Review AI Suggestions**: Confirm that each suggested category matches your team's workflow. 3. **Use Sample Detections**: Review sample detections when available to understand what the rule detects. 4. **Monitor Provider Status**: Check rules that are disabled in the provider. ## Related Documentation * [Custom Detections](/events/custom-detections) - Create custom detections using Wirespeed's query language * [Advanced Queries](/events/advanced-queries) - Learn how to query events in Wirespeed's SIEM * [Verdicts](/verdicts/introduction) - Understand how detections are automatically processed and escalated # Custom Detections Source: https://docs.wirespeed.co/events/custom-detections Create detections for activity in your SIEM data Create custom detections with **Ask Wirespeed**. Describe the activity you care about, and the assistant finds the right data, builds and tests the rule, and shows it to you for confirmation. Custom detections run every 15 minutes. Matches follow the same [verdict processing](/verdicts) as other Wirespeed detections. ## How matching works A custom detection watches one source table and uses a `WHERE` predicate to decide which events match. A WHERE predicate is simply the filtering part of a SQL query — the conditions that come after `WHERE`. For example, these conditions match successful email-send events on the `microsoft_ual_logs` table: ```sql theme={null} Operation = 'Send' AND ResultStatus = 'Success' ``` You do not need to include `SELECT`, `FROM`, or the `WHERE` keyword. Wirespeed adds the source table, your team's metadata, and the time range automatically. Each event that matches the conditions creates one detection. This keeps every detection tied to a real source event, with its original time, integration, and related assets available for investigation. Ask Wirespeed can also check surrounding activity. For example, a rule can match a successful login only when the same user had many failed logins during the previous two hours. The assistant keeps these lookbacks scoped and time-limited so the rule can run reliably. ## Suppress repeated detections Some rules can match several closely related events. You can suppress these repeats by choosing: * The related asset types to compare, such as users, endpoints, files, IP addresses, or domains * A suppression window of 15 minutes, 30 minutes, 1 hour, 4 hours, 12 hours, or 1 day When the same rule fires again within that window and shares **any** selected asset with the earlier detection, Wirespeed closes the newer detection. Its timeline explains why it was closed and links back to the original detection. The window starts from the original detection. Closed repeats do not extend it, so new activity can create another detection after the window ends. Suppression depends on the selected asset being present on the matched event. For example, user-based suppression works only when the event identifies a user. This makes threshold rules much simpler. A mass-email rule can find users with at least 100 sends in 15 minutes, then use **User** suppression for 15 minutes. Wirespeed keeps the first detection and closes the additional matches for that user. ## Before you confirm Ask Wirespeed checks the connected table and fields, runs the rule against recent data, and shows: * How many events matched * The source and filtering conditions * Query performance * Any repeat-suppression settings Rules must return no more than 100 matches during verification and complete within the production query limits. If a rule is too broad or slow, the assistant narrows it before presenting it. ## Always Notify **Always Notify** escalates every matching detection, even when automated triage would resolve or monitor it. It also takes precedence over repeat suppression. Exclusion rules still apply. ## Related Documentation * [Off-Platform Detections](/events/automated-custom-edr-detections) - Review custom detection rules imported from connected security providers # Introduction to Events Source: https://docs.wirespeed.co/events/introduction Ingest events, logs, and more from your source system into Wirespeed's SIEM Wirespeed stores events from your integrations in its SIEM and normalizes key activity for cross-source investigation. ## Event views * **Explore** searches SIEM 2.0 vendor and normalized tables with Wirespeed Expression Language (WEL). * **Advanced** runs SQL for manual analysis and exports. * **Legacy** remains available for teams with retained OCSF events. Create [custom detections](/events/custom-detections) with **Ask Wirespeed**, not from Advanced. The assistant inspects your connected schema, builds a source-aware WHERE predicate, executes it under the production limits, and shows the match count before you confirm. Some ingested events are tagged as productivity activity (mailbox and related collaboration actions). That data powers features such as the **Identity Login** case monitor. If you see a timeline note that productivity logs are not available, the monitor needs more of that event volume in Wirespeed—see [Case monitors and productivity logs](/verdicts/introduction#case-monitors-and-productivity-logs). # Introduction to Exclusions Source: https://docs.wirespeed.co/exclusions/introduction Auto-close detections with exclusions created by Ask Wirespeed and refined by you Exclusions are a very powerful feature and when used correctly can reduce your false positive rate to zero. However, when done improperly they can silence important critical detections. Ask Wirespeed drafts the narrowest safe rule for you, and the Wirespeed team is always here to help you review exclusions before deploying them. An exclusion automatically closes a detection that matches its query. Queries follow a simple `property=value` format, combining expressions with `AND` or `OR`, and you can wrap groups of conditions in parentheses to control precedence. A simple example is `category=IDENTITY__LOGIN AND prevented=true`, which automatically closes login cases that were already prevented by the source system. ## Create with Ask Wirespeed To create an exclusion use the `/exclusion` skill and let Ask Wirespeed draft it for you. Anywhere you can create an exclusion — **Settings → Exclusions**, a case, a detection, or an asset — you'll find a **Create with Ask Wirespeed** (or **Ask Wirespeed**) button that opens the chat with the exclusion workflow already loaded and the relevant context prefilled. Describe, in plain language, what you want to stop alerting on. The agent then: * **Reads the real evidence.** It inspects the selected case or detection and builds the query only from field values that actually appear there — never invented emails, hosts, IPs, hashes, or locations. * **Scopes to the narrowest safe rule.** It prefers several independent constraints joined with `AND` (exact category, specific account, endpoint, network/location, process command, or file hash) so the rule captures your intended benign pattern without hiding true positives. * **Considers timeframe.** It decides whether the activity is time-bounded (a penetration test, travel, a maintenance or migration window) or an ongoing pattern, and sets an appropriate [TTL](#ttl) so temporary approvals expire on their own. * **Asks when it's unsure.** If the scope or duration is ambiguous — or if you ask for something broader than the evidence supports — it asks one focused question (often as selectable choices) rather than guessing. * **Presents a draft for confirmation.** Nothing is saved until you confirm. You'll see the proposed name, query, description, and TTL. If you want it tighter or broader, just say so and it re-drafts. Ask Wirespeed will not refuse a request outright — even for dual-use tooling like remote-management software or PowerShell. Instead it narrows the scope (for example, to an exact hash or exact command plus category and actor) and asks for whatever it's missing. ## Editing an Exclusion After an exclusion is created you can still edit it — including the raw query, TTL, and settings — from **Settings → Exclusions**. Because you're editing the query directly there, the rest of this page documents the query syntax so you can read, review, and adjust what the agent produced. ## Query Format ### Example Detection Query Format * `property=value` * `property.sub=value` * `property=value AND property=value` * `property=value OR property=value` * `(property=value AND property=value) OR property=value` *Is that enough `property=value`s for you?* ### Operators | Operator | Description | | - | - | | = | equal | | != | not equal | | >= | greater than or equal | | \<= | less than or equal | | > | greater than | | \< | less than | | \~ | contains | | !\~ | not contains | | @= | all array values equal | | @\~ | all array values contain | | @\~= | some array values equal | | @\~\~ | some array values contain | | @!= | no array values equal | | @!\~ | no array values contain | ### Property Values You will be provided with a JSON document containing the property values you can query from. These are values from your detection and all of its associated assets. When typing in the search, property names will autocomplete. ```json theme={null} { "id": "WSPD-24", "name": "Late stage tools", "description": "LST \"Mimikatz\" discovered", "users": [{ "email": "jake@wirespeed.co" }, { "email": "tim@wirespeed.co" }], "externalIP": "1.1.1.1", "internalIPs": ["10.0.0.1", "10.0.0.2"], "files": [{ "name": "powershell.exe", "path": "C:\\Users\\Tim" }], "locations": [], "createdAt": "2024-11-02T15:36:00.433Z" } ``` | Query | Result | Description | | - | - | - | | `name="Late stage tools"` | true | `name` equals `"Late stage tools"` | | `id~WSPD` | true | `id` contains `WSPD` | | `createdAt>2024-11-01T15:36:00.433Z` | true | `createdAt` is greater than `2024-11-02T15:36:00.433Z` | | `name=null` | false | `name` is empty | | `externalIP~"1.1.1.0/24"` | true | `externalIP` is in cidr range `1.1.1.0/24` | | `description=/.*mimikatz.*/i` | true | `description` matches regular expression `/.*mimikatz.*/i` | | `description="LST Mimikatz discovered"` | true | `description` equals `"LST Mimikatz discovered"` | ### Arrays Arrays are flattened and can be queried with the special @ operators. Pay special attention to what array operator you are using. For example, using the "some array values equal" operator (@\~=) will automatically close any cases containing at least one match, even if other values in the array do not match. Ensure this is the intended action. | Query | Result | Description | | - | - | - | | `files.name@=powershell.exe` | true | All files' name equals `powershell.exe` | | `files.path@=C:\Users\Tim` | true | All files' path equals `C:\Users\Tim` | | `files.name@~shell` | true | All files' name contains `shell` | | `internalIPs@~"10.0.0.0/24"` | true | All internalIPs are in cidr range `10.0.0.0/24` | | `users.email@~="jake@wirespeed.co"` | true | Some users' email equals `jake@wirespeed.co` | | `users.email@~~jake` | true | Some users' email contains `jake` | | `users.email@!="some value"` | true | No users' email equals `some value` | | `users.email@!~none` | true | No users' email contains `none` | | `locations=null` | true | No locations values | Dates must be provided in ISO 8601 format

Email addresses, CIDR ranges, and strings with spaces in them must be quoted

Double-nested object arrays (for example `indicators.observables.type`) are flattened to leaf values for comparison — matches are not correlated to the same parent object across clauses

If a string contains quotes inside of it, they are removed during comparison

Backslashes in strings are double escaped when presented in the UI, you only need to provide one escape when referring to them ## Settings Exclusions can be disabled and will not be used until they are reenabled. Once an exclusion has caused a detection to be automatically closed it cannot be deleted, only disabled. If you would like an exclusion removed from your audit log and deleted please open a support ticket. ### TTL You can set a TTL for an exclusion. This will automatically disable the exclusion after the specified amount of time. When Ask Wirespeed recognizes a time-bounded activity, it sets the TTL to the shortest window that covers it, so the rule expires without you having to remember to remove it. #### Rolling TTLs Rolling TTLs reset their timer each time the exclusion matches a detection. This ensures that common patterns in your environment remain excluded as long as they occur regularly. If the pattern stops occurring, the TTL will eventually expire and future occurrences will no longer be excluded. Ask Wirespeed uses a rolling TTL only for an ongoing pattern, and a fixed (non-rolling) TTL for a one-time window such as a penetration test. ### Suppress source system updates By default, when Wirespeed automatically closes a detection because it matched an exclusion, we also sync that outcome to the integration (for example, closing or updating the alert in the vendor console). You can enable **Suppress source system updates** on an exclusion to stop that outbound sync for detections matched by that rule. Use this when you only want to silence or auto-close detections inside Wirespeed without changing how the alert appears or is handled in the source product. ## Examples and Trade-offs Writing exclusions can reduce the noise from false-positive alerts, but it can also come at the trade-off of ignoring true positives, opening your organization up to risks that prevent Wirespeed from protecting you. Ask Wirespeed applies the same trade-offs below and defaults to the tightest version of a rule — the examples here explain the reasoning so you can review a draft, or edit a query, with confidence. ### Dealing with Safe Executables It's possible to use exclusions to prevent escalations or remediation for known-good applications. However, this requires a critical eye to be done effectively with a good risk trade-off. #### A Simple Example The following is an example to allow a specific version of a known-good executable to run. In this case, the executable was a helper application for banking software. It has only one purpose and is published directly by the business bank, with no history of being abused by attackers. Ideally, files like this would be enriched by their hashes, such as the `SHA256` hash in this case, but it wasn't found in Reversing Labs' library of over 40 billion files. The best solution would be to submit that file for analysis and inclusion in their repository of files, but that's not often feasible, so a simple exclusion like this can be safe enough to avoid future false-positive alerts: ``` files.sha256@~=e7fc1d55726578f20d3336ed4391e4f7ee362ef77da3ccd4b5a38d18e31ccab5 ``` #### Excluding Remote Management Tools The following can deceptively appear to be similar to the example above, but it comes with opening your organization to risks that Wirespeed does NOT recommend: ``` files.sha256@~=9cfd2c521d6d41c3a86b6b2c3d9b6a042b84f2f192f988f65062f0e1bfd99cab ``` The difference in this case is that hash is for `ScreenConnect.WindowsClient.exe`, which is the primary executable for the ScreenConnect product, a remote management and IT help tool, that also happens to be commonly abused by attackers who leverage social engineering to masquerade as your IT support to your users, tricking them into running this legitimate application, but pointed at their remote management instance so that they can conduct nefarious steps, which can often lead to ransomware. It is critical that you understand if an executable has a dual-use capability before you add it as an exclusion. #### Excluding Live off the Land Tools This is another deceptively simple exclusion that introduces significant risk: ``` files.sha256@~=1f9ffc2227f8dea8b771d543c464cf8166c22a39420a5322b5892a640c4b34b6 ``` This exclusion will ignore alerts from the Microsoft `powershell.exe` binary. This is of course an official binary, but adding exclusions for it allows attackers to execute all kinds of badness, from first stage malware to privilege escalation, even in some cases locking you out of your files in ransomware. Wirespeed highly recommends never adding exclusions for known Live off the Land Tools. #### Using Processes Instead Another approach to dealing with `powershell` might be to exclude a specific process that is acceptable, like this example, which is powershell retrieving the name of the DNS domain the computer is joined to, which is common for legitimate software to do (and also common for attackers orienting themselves within your environment, but probably OK to ignore since there would likely be other detections beyond this that are higher fidelity signal to indicate their presence): ``` processes.command@="powershell $env:USERDNSDOMAIN" ``` Observe that the operator is `@=` and not `@~=`. Processes is an array (collection of many processes), so we need to use an array operator. The operator we chose requires every process to match "powershell \$env:USERDNSDOMAIN", unlike the following exclusion, which only needs a single process in the detection to match: ``` processes.command@~="powershell $env:USERDNSDOMAIN" ``` In that example, the detection could contain other processes which are a much higher signal of attacker behavior, resulting in a false-positive dismissal of an important alert. Exclusion logic is powerful, but must be precise. When in doubt, let Ask Wirespeed scope it for you or reach out and ask for help via support chat. ### Privacy VPNs Allowing your organization to use Privacy VPNs when logging in can pose a significant challenge to detecting malicious logins. A better approach would be to prevent their use in your SSO and Authentication systems, such as Conditional Access Policies in Microsoft. However, if that's not possible, here are some examples. Also, without creating exclusions at all, Wirespeed will learn to trust specific attributes of cases as you mark them as malicious or benign. For example, a suspicious login case that is closed as benign causes Wirespeed to remember that IP address for 30 days. When a user gets a detection at that IP in the 30 days following, it becomes automatically closed as benign, and the clock is reset for another 30 days from that point for more logins. Further, to reduce impact on the security team from working escalations from Wirespeed, we highly recommend enabling Chat Ops to do this work for you. We will reach out to end users, ask them if they just logged in from an unusual location, authenticate them out of band (if enabled), and learn the safe locations ... all without putting any burden on you. #### How NOT to create an Exclusion for Privacy VPNs The following exclusion is very loose and opens your organization up to significant risk, by simply ignoring (excluding) any detection or alert associated with NordVPN. This logic goes beyond just Login detections and could potentially exclude malware cases involving an IP address from NordVPN, as well as any user in your entire organization. Attackers use NordVPN, too, so this exclusion is NOT recommended. ``` ips.metadata.privacy.service="NordVPN" ``` #### Slightly Better By adding the Login category, this exclusion will now no longer apply to other types, such as Execution (malware) or Invocation (cloud control plane). It is still quite loose and not recommended, because it allows any user, and it's probable an attacker using NordVPN at some point could steal credentials or sessions and login with them from that provider, hit this exclusion rule, and there would be no alert: ``` category="IDENTITY__LOGIN" AND ips.metadata.privacy.service="NordVPN" ``` #### Specific Users Building on the above, if we add another AND clause, wrap it in parentheses, and specify the email addresses of the specific users we expect to be using NordVPN, then we get an even tighter rule. It still comes with the risk that an attacker could steal the credentials for these particular users and attempt to login with them, though: ``` category="IDENTITY__LOGIN" AND ips.metadata.privacy.service="NordVPN" AND (directory.email="tim@taco.company" OR directory.email="jake@taco.company") ``` #### A Very Tight Example This example builds on the one before, but further restricts it to Austin, Texas. As a result, the likelihood of an attacker being able to steal credentials for the named users, use this specific privacy VPN, from this specific city and region, really reduces the odds of missing a true positive. It's still preferable to block privacy VPNs in authentication settings or let ChatOps handle this for you, but if those aren't good options for some reason, this is available: ``` category="IDENTITY__LOGIN" AND ips.metadata.privacy.service="NordVPN" AND (directory.email="tim@taco.company" OR directory.email="jake@taco.company") AND ips.metadata.city="Austin" AND ips.metadata.region="Texas" ``` ### Dealing with Shared Accounts This is an example for how to craft an exclusion for a specific user account that is shared and logged in at various locations. It comes with serious risk trade-offs, though. It is ALWAYS best to follow security best practices, have good hygiene, use strong authentication (MFA), and NOT SHARE ACCOUNTS. But sometimes the security team gets overruled by the business, so this is an example for how to deal with that scenario. First, this exclusion is restricted to the Login category, so it's not wide open for things like malware reaching out to a location that we observe, or a user making suspicious changes in your AWS or Azure cloud control plane (Invocation). Second, this exclusion is restricted to several U.S. states: California, Arizona, Washington, Oregon, and Nevada. Not the best, but in this particular case, there is a business reason for it. Third, to compensate for the wide logic of the several U.S. states, any matching IP addresses must not have any of the privacy flags set on them: VPN, Proxy, TOR, Relay, or Hosting Provider. While no dataset is perfect, we have an excellent geographic enrichment that we apply to every single IP address we touch. The result of this logic will restrict to only IPs that physically reside at businesses and homes in those U.S. states. Data Center IP addresses (except for small private data centers that belong to specific businesses, not co-locations or cloud providers) will not match the logic. The result is an attacker must physically be located in those states. Most (not all) financially motivated criminal actors will likely use hosted infrastructure to put a layer between you and their identification and attribution. So while this is not preferred (it's always better to avoid this situation), this is a way to handle this scenario more safely than others. ``` category="IDENTITY__LOGIN" AND directory.email="shared-user@taco.company" AND (locations.state="California" OR locations.state="Arizona" OR locations.state="Washington" OR locations.state="Oregon" OR locations.state="Nevada") AND ips.metadata.privacy.vpn=false AND ips.metadata.privacy.proxy=false AND ips.metadata.privacy.tor=false AND ips.metadata.privacy.relay=false AND ips.metadata.privacy.hosting=false ``` # Frequently Asked Questions Source: https://docs.wirespeed.co/faq Answers to common questions from Wirespeed users ## **Can I use Wirespeed on my phone?** Wirespeed is installable as a Progressive Web App, so you can add it to your home screen and open it like a native app. There is no separate App Store or Play Store listing. * **iPhone / iPad:** Open [app.wirespeed.co](https://app.wirespeed.co) in Safari, tap Share, then **Add to Home Screen**. * **Android:** Open [app.wirespeed.co](https://app.wirespeed.co) in Chrome, then tap **Install app** or **Add to Home screen** from the browser menu. ## **How do I set up integrations as a non-admin user?** If you are not an administrator for the account you are trying to integrate, you have a couple options: * If the integration is an OAuth integration, there will be a “Copy Link for Admin” button that you can use to copy and share the link to your account administrator. They will be able to go to that link, configure OAuth consent and will be notified if the integration worked successfully. * If the integration requires API keys or other credentials, the relevant documentation can be found underneath the Integrations documentation and shared with your administrator. Once they have gathered the appropriate information and shared it with you, it can be entered into the application. ## **What timezones do you display your data in?** All datetimes shown in the UI are presented in your timezone. All datetimes returned from the API are provided in UTC. ## **What is an automation lock?** You may see terms like "VIP Locked" or "Technical User Locked". This means that a user on your team has manually changed the status of that record to be enabled/disabled and is excluded from any future automations. This is to prevent a disabled VIP from be reenabled the next time the automation is run. Every record with a lock has the ability to remove the lock by going to its table, clicking on the 3-dot menu, and selecting "Disable lock". ## **Why isn't my team receiving emails? / How do I prevent Wirespeed emails from going to spam?** Ensure your organization's spam filters have [wirespeed.co](https://wirespeed.co) allow-listed, or your team may not receive emails as expected. See instructions to accomplish this for your integrated email service: * [Microsoft](/integrations/microsoft/#allow-listing-wirespeed-emails) * [Google Workspace](/integrations/google-workspace#allow-listing-wirespeed-emails-in-the-google-admin-console) ## What does "Productivity logs are not available, skipping monitor" mean? That timeline message is informational. It usually means the Identity Login case monitor did not see enough recent productivity log volume in Wirespeed to run. See [Case monitors and productivity logs](/verdicts/introduction#case-monitors-and-productivity-logs) under Introduction to Verdicts for which integrations supply this data and what to check. ## **Does Wirespeed detect insider threats?** No. Insider threat is not part of Wirespeed's threat model. Wirespeed is built to detect external adversaries, compromised accounts, malware, and unauthorized access. We do not investigate or escalate activity from trusted users who are acting with legitimate credentials and permissions, even when that activity is harmful or policy-violating. In practice, this means Wirespeed is optimized to detect when an attacker gets in—not when an authorized employee misuses their access. Alerts that reflect normal use of permissions a user already holds may not result in a case. ## How does Wirespeed approach penetration testing / simulated security detections / red-team activity? We respond to all penetration tests and red team activities as if they represent an active breach, given the possibility of concurrent real threats in your infrastructure. If scheduling this activity, it may be prudent to add corresponding [exclusions](./exclusions/introduction) highly specific to the expected activity for the time alotted if (and only if) you'd rather not see us generate cases for the simulation. # Introduction to Groups Source: https://docs.wirespeed.co/groups/introduction Organize assets and control automation behavior with groups and rules Groups organize your users and endpoints so you can control how Wirespeed applies automation to those assets. Create and edit groups under **Settings > Groups**. ## How Groups Work | Setting | Effect when disabled | | - | - | | **Chat Ops** | Assets in this group will not be contacted during chat ops. Detections involving them are marked as suspicious and escalated instead. | | **Remediation** | Assets in this group will not be automatically remediated. Manual remediation from the case Actions menu is still available. | | **Update Source System** | When off, verdict, status, notes, and comment changes are not synced back to the detection integration for assets in this group. This is evaluated alongside the [integration-level source update settings](/integrations/introduction#source-system-updates). | | **Always Notify** | When on, detections involving assets in this group are always escalated for notification. Resolve verdict paths become escalate, chat ops verdict paths become escalate with chat ops still running (remediation actions are preserved), and monitor verdict paths become escalate (monitoring does not start). | If an asset belongs to **any** group that has a setting disabled, that automation is disabled for the asset — even if other groups the asset belongs to have it enabled. Always Notify is opt-in per group. If an asset belongs to **any** group with Always Notify enabled, the override applies to that detection. The same Always Notify behavior is also available on [custom detections](/events/custom-detections) and imported vendor rules. Exclusion rules still take precedence and will close matching detections without notification. ## System Groups Wirespeed seeds a set of built-in groups that are automatically maintained. System groups are indicated by the Wirespeed logo and cannot be deleted. ### User Groups | Group | Description | Default Chat Ops | Default Remediation | | - | - | - | - | | **VIP** | High-profile users requiring priority monitoring and response | Off | Off | | **Administrator** | Users with elevated privileges across systems | On | On | | **External** | Contractors, vendors, and other non-employee users | On | On | | **Technical** | Engineering, IT, and other technical staff | On | On | | **Financial** | Users with access to financial systems and data | On | On | | **NHI** | Non-human identities such as service accounts and API keys | Off | Off | ### Endpoint Groups | Group | Description | Default Chat Ops | Default Remediation | | - | - | - | - | | **Critical Asset** | Business-critical servers and infrastructure | Off | Off | | **Domain Controller** | Active Directory domain controllers | Off | Off | | **Server** | Server endpoints running production or internal services | Off | Off | | **Workstation** | Desktop and laptop endpoints used by employees | On | On | | **Mobile** | Mobile devices including phones and tablets | On | On | ## Custom Groups Create your own groups to match your organization's structure. Each custom group has: * **Name** — a short label displayed throughout the platform * **Description** — optional context for your team * **Color** — visual identifier shown on badges * **Chat Ops** — enable or disable chat ops for the group * **Remediation** — enable or disable remediation for the group * **Always Notify** — always escalate for notification (see table above) * **Source systems updated** - Sync detection changes related to these assets back to your detection platforms. Custom groups can be deleted when no longer needed. ## Group Rules Rules automatically assign assets to groups based on field matching. This keeps group membership up to date as your directory syncs without any manual work. ### Rule Properties | Property | Description | | - | - | | **Asset Type** | Whether the rule applies to **Users** or **Endpoints** | | **Group** | The group to assign matching assets to | | **Field** | The asset field to match against | | **Search Pattern** | The pattern to match (text with wildcards or regex) | ### Matchable Fields **User fields:** | Field | Description | | - | - | | `email` | User's email address | | `name` | User's display name | | `username` | User's login username | | `title` | Job title | | `department` | Department or business unit | | `role` | Assigned role | **Endpoint fields:** | Field | Description | | - | - | | `name` | Endpoint hostname | | `OS` | Operating system | | `ip` | IP address | ### Pattern Types **Text** — used by custom rules. Use `*` as a wildcard. For example: * `ceo@*` matches any email starting with `ceo@` * `*admin*` matches any value containing `admin` * `*@example.com` matches any email at that domain **Regex** — used exclusively by Wirespeed-managed system rules for advanced matching. Custom rules cannot use regex patterns. System rules (indicated by the Wirespeed logo) cannot be deleted, but they can be disabled. Custom rules can be deleted or disabled at any time. ### When Rules Run Rules are evaluated automatically after each directory or endpoint sync. When an asset matches a rule, it is added to the corresponding group. If a rule is later disabled or the asset no longer matches, the assignment is removed — unless a user has manually overridden the membership. ## Viewing Group Membership When viewing a user or endpoint detail page, their assigned groups are displayed as badges. Hover over any group badge to see which rule matched the asset to that group. ## Manual Overrides You can manually add or remove assets from groups on the individual user or endpoint detail pages. Manual assignments take priority over rule-based assignments: * **Manually adding** an asset to a group persists even if no rule matches it. * **Manually removing** an asset from a group persists even if a rule would otherwise assign it. ## Groups and Directory Sync Group membership is synced during directory and endpoint sync operations. Until the initial sync completes, automation decisions that depend on group membership (like remediation) are deferred to avoid acting on incomplete data. # 1Password Source: https://docs.wirespeed.co/integrations/1password Monitor sign-in attempts, audit events, and item usage across your 1Password account The 1Password integration allows you to ingest security-relevant events from your 1Password account, including: * **Sign-in attempts**: Track successful and failed authentication attempts * **Audit events**: Monitor administrative actions and configuration changes * **Item usages**: See when credentials and secrets are accessed ## Prerequisites Before setting up this integration, ensure you have: 1. A 1Password Business or 1Password Teams account 2. Owner or administrator privileges in your 1Password account 3. Access to the 1Password Admin Console ## Step 1: Create an Events Reporting Integration 1. Sign in to your [1Password Admin Console](https://start.1password.com/) 2. Navigate to **Integrations** in the sidebar 3. Click **Directory** at the top 4. Search for **Events Reporting**, select Other 5. Click **Add Integration** 6. Give your integration a descriptive name (e.g., "Wirespeed Events Integration") 7. Click **Save** ## Step 2: Generate a Bearer Token After creating the integration: 1. You'll see a **Set up token** section 2. Click **Generate token** (or **Regenerate token** if one already exists) 3. Under **Events to Report**, select all three event types: * Sign-in attempts * Item usages * Audit events 4. **Important**: Copy and securely save the token immediately. You won't be able to see it again. 5. The token will look like: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...` Store your bearer token securely. If you lose it, you'll need to regenerate a new one, which will invalidate the old token. Each event type is a separate token feature. If you omit one, Wirespeed still connects and collects the selected types. The missing feature appears as an entitlement warning on the integration page rather than as a repeating error. ## Step 3: Identify Your Server URL 1Password uses different server URLs based on your account type and region. Use the appropriate URL: | Account Type | Server URL | | - | - | | 1Password Business (US) | `https://events.1password.com` | | 1Password Business (Canada) | `https://events.1password.ca` | | 1Password Business (EU) | `https://events.1password.eu` | | 1Password Enterprise | `https://events.ent.1password.com` | If you're unsure which server to use, check your 1Password sign-in URL. If you sign in at `my.1password.ca`, use the Canada server (`events.1password.ca`). ## Step 4: Add the Integration in Wirespeed 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Search for and select **1Password Events API** 3. Enter the following information: * **Server URL**: The appropriate server URL from Step 3 * **API Token**: The bearer token you generated in Step 2 4. Click **Integrate** to complete the setup ## What Events Are Collected? ### Sign-In Attempts These events track authentication attempts to your 1Password account, including: * Successful sign-ins * Failed authentication attempts * MFA challenges * Blocked sign-in attempts due to policy ### Audit Events Administrative and configuration events, including: * User management (invites, removals, role changes) * Vault creation and permissions changes * Group management * Policy changes * Integration setup ### Item Usages Events showing when secrets are accessed: * Credential reveals * Password copies * Autofill usage * Item exports ## Troubleshooting ### Authentication Errors If you see authentication errors: 1. Verify your bearer token is correct and hasn't expired 2. Ensure you're using the correct server URL for your account type 3. Check that your integration is still active in the 1Password Admin Console ### Missing Event Types If the integration shows a warning that a token feature is missing (sign-in attempts, item usages, or audit events): 1. Open the 1Password Admin Console and edit the Events Reporting integration 2. Generate a **new** token with the missing event type selected under **Events to Report** 3. Update the API token in Wirespeed The previous token cannot be expanded with additional event types. Regenerating replaces it. ### No Events Appearing If events aren't showing up: 1. Events may take a few minutes to appear after initial setup 2. Verify that activity is occurring in your 1Password account 3. Check that your 1Password account has the Events Reporting feature enabled ### Rate Limiting The 1Password Events API has rate limits. If you encounter rate limiting: 1. Wirespeed will automatically retry with exponential backoff 2. Events will be collected on the next sync cycle ## Additional Resources * [1Password Events API Documentation](https://developer.1password.com/docs/events-api/) * [1Password Events API Reference](https://developer.1password.com/docs/events-api/reference/) * [Setting Up Events Reporting](https://developer.1password.com/docs/events-api/get-started/) # Acronis Source: https://docs.wirespeed.co/integrations/acronis Import Alert Manager detections from Acronis Cyber Protect Cloud ## Integrate Wirespeed with Acronis Use a partner **API client** from the Acronis portal. CyberApp / Vendor Portal registration is **not** required for this integration. 1. Log in to the **Acronis portal** (including Circle white-label portals) 2. Click **Manage Account** 3. Open **Settings** 4. Click **API clients** 5. Create an API client and copy the **Client ID**, **Client secret**, and **data center URL** (the secret is shown only once) 6. Log into Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 7. Select **Acronis** and enter: * **Datacenter URL** (for example `https://us-cloud.acronis.com`) * **Client ID** * **Client Secret** 8. Click **Integrate** Wirespeed polls Acronis **Alert Manager** (`GET /api/alert_manager/v1/alerts`) and maps alerts into detections. This includes email-security alerts such as BEC, phishing, malicious, and spam, as well as other Alert Manager types (for example backup and protection alerts). Wirespeed also syncs registered agents from **Agent Manager** (`GET /api/agent_manager/v2/agents`) as endpoints. On first sync, Wirespeed backfills alerts from the last **7 days**. Use API client credentials created under Manage Account → Settings → API clients, with the datacenter URL from that dialog. Do not use CyberApp `/bc/idp/token` credentials for this integration. # Admin By Request Source: https://docs.wirespeed.co/integrations/admin-by-request Ingest endpoint privilege management security events from Admin By Request The Admin By Request integration polls security events from your tenant API and syncs managed endpoint inventory into Wirespeed. ## What This Integration Does * Polls the Admin By Request [Events API](https://www.adminbyrequest.com/en/docs/events-api) * Ingests privilege changes, policy blocks, break-glass logons, and related endpoint events * Syncs managed workstations from the [Inventory API](https://www.adminbyrequest.com/en/docs/inventory-api) * Maps events to Wirespeed detections with host, user, and file context when available ## Prerequisites Before setup, make sure you have: 1. An Admin By Request tenant with API access enabled 2. An API key from **Settings → Tenant Settings → Data → API Keys** 3. Your tenant **API data center prefix** (for example `dc1api`, `dc2api`) shown under **About API Keys** ## Step 1: Enable the API and Create a Key In the Admin By Request portal: 1. Go to **Settings → Tenant Settings → Data → API Keys** 2. Create or copy an API key 3. Note the data center prefix for your tenant (for example `dc1api` for EU West) Use the correct data center prefix. Connecting to the wrong `dc*api` host causes API errors. ## Step 2: Add Admin By Request in Wirespeed 1. Go to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Search for **Admin By Request** 3. Enter: * **API Data Center** (for example `dc1api`) * **API Key** * **Event Codes Filter** (optional; leave blank for the default high-signal set) 4. Click **Integrate** During onboarding, Wirespeed validates credentials with `GET /inventory?take=1`. ## Detection Ingestion Behavior * Default ingest set covers high-signal event codes (privilege changes, execution blocks, break glass, session denials) * Pagination uses monotonic event `id` cursors (`startid`) between runs * Initial sync is capped to avoid backfill floods on large tenants ## Endpoint Inventory Behavior * Full directory sync on each run via `GET /inventory` * Pagination uses monotonic inventory `id` cursors (`startid`) within the run only * Maps hostname, OS, IP addresses, agent version, and last inventory timestamp; live status uses `inventoryAvailable`, with a 4-hour `inventoryDate` fallback per ABR's inventory refresh interval ## Troubleshooting ### Authentication Failures Check: 1. API key is valid and API access is enabled in the portal 2. **API Data Center** matches the prefix shown under **About API Keys** 3. The key has not exceeded the vendor daily API quota (100,000 calls/day) ### No Detections Appearing Check: 1. Admin By Request is generating events in the portal (for example policy blocks or privilege changes) 2. Event codes are not excluded by a custom **Event Codes Filter** 3. Initial sync may take a few minutes depending on backlog volume ## Additional Resources * [Admin By Request Public API overview](https://www.adminbyrequest.com/en/docs/api-overview) * [Events API](https://www.adminbyrequest.com/en/docs/events-api) * [Inventory API](https://www.adminbyrequest.com/en/docs/inventory-api) * [Auditlog API](https://www.adminbyrequest.com/en/docs/auditlog-api) # Agger Labs Source: https://docs.wirespeed.co/integrations/agger-labs Import anti-ransomware incidents and endpoint inventory from Agger Labs The Agger Labs integration syncs anti-ransomware incidents and endpoint inventory from Agger into Wirespeed, including: * **Ransomware incidents**: Canary, tampering, startup guard, and Agger trigger detections * **Endpoint inventory**: Devices with the Agger agent installed, including hostname, operating system, and online status ## Prerequisites Before setting up this integration, ensure you have an Agger Labs tenant with admin access ## Step 1: Create an API Client 1. Log in to your Agger admin console 2. Create an API client scoped to the companies you want Wirespeed to access 3. Grant at least these permissions: * `read:incidents` * `read:endpoints` * `update:endpoints` 4. Copy the **Client ID** and **Client Secret** Store the client secret securely. Agger may only show it once when the API client is created. ## Step 2: Add the Integration in Wirespeed 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Search for and select **Agger Labs** 3. Enter your **Client ID** and **Client Secret** 4. Click **Integrate** to complete the setup ## What Gets Synced? ### Incidents (Detections) Wirespeed ingests anti-ransomware incidents from Agger, including process details, SHA256 hashes, mitigation status, and affected endpoints. ### Endpoints All endpoints with the Agger agent are synced as endpoint inventory, including hostname, operating system, IP addresses, and online status. ## Troubleshooting ### Authentication Errors If you see authentication errors: 1. Verify the client ID and secret are correct 2. Confirm the API client has `read:incidents` and `read:endpoints` permissions 3. Confirm the API client is scoped to the expected companies ### No Incidents Appearing If incidents aren't showing up: 1. Incidents may take a few minutes to appear after initial setup 2. The initial sync pulls up to the newest 5,000 incidents 3. Verify that incidents exist in your Agger console ## Additional Resources * [Agger API Documentation](https://api.ransomwarekiller.com/swagger/index.html?urls.primaryName=V1) On first sync, Wirespeed fetches up to the newest **5,000** incidents. # Anthropic Source: https://docs.wirespeed.co/integrations/anthropic Integrate with Anthropic for usage and security event ingestion Anthropic integration documentation is coming soon. You can express interest from [Integrations → View all](https://app.wirespeed.co/settings/integrations?tab=browse\&status=coming-soon). # AWS GuardDuty Source: https://docs.wirespeed.co/integrations/aws Integrate with AWS Guard Duty Wirespeed uses the [AssumeRole API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) to integrate into your AWS accounts. ## Integrating all accounts (recommended) This method uses [AWS CloudFormation StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html) to deploy the required integration permissions across all AWS organizations underneath your root account. It will also automatically deploy Wirespeed in any new AWS accounts you deploy. We recommend you test deployment with a subset of accounts first to minimize errors. Copy our [CloudFormation Quick Link](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https://s3.us-west-2.amazonaws.com/aws-deploy.wirespeed.co/deploy-template.yaml\&stackName=Wirespeed-GuardDuty-Integration), login to your desired AWS console account, and navigate to the copied link to deploy to a single account. ### In Wirespeed 1. Navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > AWS GuardDuty > Organization-wide 2. **Copy the API key** for use in **Step 2** below ### In AWS Ensure all accounts you want to integrate with have Guard Duty enabled. If not, the integrations will be set to failed. 1. Log in to your root AWS account on the AWS console **as an Administrator** 2. Ensure [Trusted Access](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html) has been enabled for your account 3. Navigate to **CloudFormation** > **Stack Sets** > **Create Stack Set** 4. Continue with the steps below #### Step 1 1. Permission Model > Service-Managed Permissions 2. Prepare Template > Template is ready 3. Specify Template > **Amazon S3 URL** > `https://s3.us-west-2.amazonaws.com/aws-deploy.wirespeed.co/deploy-template.yaml` #### Step 2 1. Use a sensible name and description 2. Provide the **API key** you copied from the **Getting Started** > **In Wirespeed** step above #### Step 3 1. Acknowledge the disclaimer #### Step 4 1. Leave all defaults selected 2. Choose a single region to deploy in (IAM roles are global, so you only need to choose one) #### Step 5 1. Click Submit #### Step 6 1. This stack set does not include deployment to your root management account. To deploy to that account, login to the AWS console for your root account, navigate [here](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https%3A%2F%2Fs3.us-east-1.amazonaws.com%2Fcfn.wirespeed.co%2Ftemplate.yaml\&stackName=Wirespeed-GuardDuty-Integration) and follow the instructions. Ensure the stack set deploys correctly across all accounts in your organization, address any errors as needed. Reach out to Wirespeed for assistance. Upon successful deployment, the accounts will show up in Wirespeed underneath [Integrations](https://app.wirespeed.co/settings/integrations) This Cloudformation stack will deploy in all new accounts you make in your organization going forward. ## Integrating a single account ### Cloudformation (Option A) 1. Log into Wirespeed and navigate to Integrations > [**Add New Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **AWS GuardDuty** from the dropdown 3. Select **Single Account (Auto)** 4. Copy the API key 5. Click [here](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://s3.us-west-2.amazonaws.com/aws-deploy.wirespeed.co/deploy-template.yaml\&stackName=Wirespeed-GuardDuty-Integration) to deploy a CloudFormation stack 6. Follow all instructions and default options Upon completion you will see the account added on the Wirespeed [Integrations](https://app.wirespeed.co/settings/integrations) page. ### Manual (Option B) 1. Log in to your AWS console and open the **IAM** page. 2. Go to **Access Management** > **Roles**. 3. Click **Create Role**. 4. Under **Trusted Entity Type**, select **AWS Account**. 5. Check **Require External ID** and enter a secure, randomly generated password. a. Be sure to save this information, as you'll need it later to add the account in Wirespeed. b\*\*. Note: AWS \*\*requires that the External ID match the regular expression `^[\w+=,.@:/-]*$`. 6. Choose **Another AWS Account** and enter the ID `590183894387`. 7. Select **Next** to advance to the **Add Permissions** page. 8. Open a new tab in IAM and go to the **Policies** page. Select **Create Policy**. 9. In the newly opened browser window, paste the following JSON template: ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ec2:DescribeRegions", "guardduty:EnableOrganizationAdminAccount", "guardduty:DeleteMalwareProtectionPlan", "guardduty:ListThreatIntelSets", "guardduty:GetThreatIntelSet", "guardduty:CreateDetector", "guardduty:DisassociateMembers", "guardduty:DescribeMalwareScans", "guardduty:UpdateMemberDetectors", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:AcceptInvitation", "guardduty:GetRemainingFreeTrialDays", "guardduty:UpdateMalwareScanSettings", "guardduty:ListInvitations", "guardduty:DisassociateFromAdministratorAccount", "guardduty:UpdateMalwareProtectionPlan", "guardduty:UnarchiveFindings", "guardduty:GetMemberDetectors", "guardduty:DeclineInvitations", "guardduty:DeleteDetector", "guardduty:ListPublishingDestinations", "guardduty:GetFilter", "guardduty:ListTagsForResource", "guardduty:ListMembers", "guardduty:ListIPSets", "guardduty:ListCoverage", "guardduty:CreateSampleFindings", "guardduty:GetMasterAccount", "guardduty:UpdateFindingsFeedback", "guardduty:GetCoverageStatistics", "guardduty:ListMalwareProtectionPlans", "guardduty:GetMembers", "guardduty:GetOrganizationStatistics", "guardduty:UpdateFilter", "guardduty:SendSecurityTelemetry", "guardduty:CreateThreatIntelSet", "guardduty:StopMonitoringMembers", "guardduty:CreateMalwareProtectionPlan", "guardduty:CreateFilter", "guardduty:GetMalwareScanSettings", "guardduty:DisableOrganizationAdminAccount", "guardduty:ListFilters", "guardduty:DeleteThreatIntelSet", "guardduty:GetInvitationsCount", "guardduty:GetFindings", "guardduty:DeleteMembers", "guardduty:DeleteIPSet", "guardduty:DeleteFilter", "guardduty:AcceptAdministratorInvitation", "guardduty:DeletePublishingDestination", "guardduty:ListFindings", "guardduty:DisassociateFromMasterAccount", "guardduty:DeleteInvitations", "guardduty:DescribePublishingDestination", "guardduty:GetMalwareProtectionPlan", "guardduty:InviteMembers", "guardduty:ListDetectors", "guardduty:ArchiveFindings", "guardduty:UpdateDetector", "guardduty:GetIPSet", "guardduty:StartMalwareScan", "guardduty:UpdateOrganizationConfiguration", "guardduty:StartMonitoringMembers", "guardduty:GetUsageStatistics", "guardduty:CreateMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:DescribeOrganizationConfiguration", "guardduty:GetFindingsStatistics" ], "Resource": "*" } ] } ``` 10. Click **Next**, then enter a name for the policy and select **Create Policy**. 11. Go back to the role creation window, refresh the policy list, and check the box for the newly created policy. 12. Click **Next**. 13. Provide a name for the role, then review the **Trusted Entities** section. The trust policy should resemble the following: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sts:AssumeRole", "Principal": { "AWS": "arn:aws:iam::590183894387:root" }, "Condition": { "StringEquals": { "sts:ExternalId": "[RANDOM_PASSWORD]" } } } ] } ``` 14. Ensure that the newly created policy appears in the permissions section, then select "Create Role". Note the role ARN. 15. Log into Wirespeed and navigate to Integrations > [**Add New Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 16. Select **AWS GuardDuty** from the dropdown 17. Select **Single Account (Manual)** 18. Input the **Role ARN** and **External ID** 19. Click **Integrate** On first sync, Wirespeed fetches GuardDuty findings updated in the last **90 days** (per detector and region). # Axonius Source: https://docs.wirespeed.co/integrations/axonius Import endpoint and asset inventory from Axonius. To integrate Axonius you will need 3 pieces of information: the domain of your Axonius instance, an API Key, and an API Secret. Read more about Axonius [here](https://developer.axonius.com/docs/access-the-api). ## Domain Your Axonius domain is the base URL of your Axonius instance, including the hostname and port if applicable. For example: `https://my-axonius-instance.com`. ## API Key & API Secret The API Key and API Secret are required to authenticate with the Axonius API. How you obtain them depends on your Axonius version. The account used must have a role with **API access enabled** and permissions to read device assets. We recommend using a dedicated service account for the Wirespeed integration. ### Using a Service Account (required for v6.1.74+, Recommended) 1. Click the **Gear** icon in the top right corner to access **System Settings** 2. Go to **User and Role Management** > **Service Accounts** 3. Create a service account with a role which has API permissions. The default viewer role, is sufficient. 4. Scroll down and expand **Optional details** — the API Key is displayed in the **API Key** field 5. Click **Reset** to generate a new API Key and API Secret ### Using an Individual Account (v6.1.73 and earlier) 1. Log in to Axonius with a user account whose role has API access enabled 2. Click your account avatar in the top right corner 3. Click **User Settings** > **API Key** tab 4. Click **Reset Key** to generate a new API Key and API Secret The API Secret is **only displayed once** when it is created or reset. Copy it to a safe location immediately — it cannot be recovered later. ### Connecting to Wirespeed 1. Log in to Wirespeed. 2. Navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Axonius. 3. Provide the following: * Domain * API Key * API Secret # Barracuda CloudGen Firewall Source: https://docs.wirespeed.co/integrations/barracuda-cloudgen-firewall Forward syslog events from Barracuda CloudGen Firewall ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Barracuda CloudGen Firewall** and open **Forwarder Details** (or ask Chat for the listener `ip:port`) 2. In Barracuda Firewall Admin, go to **Configuration** > **Configuration Tree** > **Box** > **Infrastructure Services** > **Syslog Streaming** and click **Lock** 3. Under **Basic Setup**, set **Enable Syslog Streaming** to **yes** 4. Under **Logstream Destinations**, add a destination with the IP and port from **Forwarder Details**. When the listener shows **UDP/TCP**, choose either TCP or UDP on the Barracuda destination. When it shows only one transport, use that one. 5. Under **Logdata Filters**, add a filter that includes the **Box** and **Service** log files plus the firewall **Activity**, **Audit**, and **Threat** logs 6. Under **Logdata Streams**, add a stream that sends the filter to the Wirespeed destination 7. Click **Send Changes** and **Activate** 8. Events will begin showing up shortly Wirespeed parses firewall activity and audit sessions, IPS threat events, scan detections, and VPN and administrator logins into dedicated fields. All other box and service log lines are stored with their log file name and message. # Bitwarden Source: https://docs.wirespeed.co/integrations/bitwarden Monitor organization events including logins, policy changes, and user activity across your Bitwarden organization The Bitwarden integration allows you to ingest security-relevant events from your Bitwarden organization, including: * **User authentication**: Track successful and failed login attempts, password changes, and two-factor authentication events * **Vault activity**: Monitor item creation, access, and modifications * **Organization management**: See user invitations, role changes, and policy updates * **Secrets Manager events**: Track access to secrets, projects, and machine accounts ## Prerequisites Before setting up this integration, ensure you have: 1. A Bitwarden Teams or Enterprise organization 2. Owner privileges in your Bitwarden organization 3. Access to the Bitwarden Admin Console The Bitwarden Public API is available for Teams and Enterprise organizations only. ## Step 1: Obtain Your Organization API Key 1. Sign in to your [Bitwarden Web Vault](https://vault.bitwarden.com/) 2. Open the **Admin Console** using the product switcher 3. Navigate to **Settings** → **Organization info** 4. Scroll down to the **API key** section 5. Click **View API Key** (you may need to re-authenticate) 6. Copy both the **client\_id** and **client\_secret** Your organization API key provides full access to your organization. Keep it private and store it securely. If you believe it has been compromised, use the **Rotate API key** button to generate a new one. ## Step 2: Identify Your Server URLs Bitwarden uses different server URLs based on your hosting option and region: ### Cloud-Hosted (US) | Server Type | URL | | - | - | | API Server | `https://api.bitwarden.com` | | Identity Server | `https://identity.bitwarden.com` | ### Cloud-Hosted (EU) | Server Type | URL | | - | - | | API Server | `https://api.bitwarden.eu` | | Identity Server | `https://identity.bitwarden.eu` | ### Self-Hosted | Server Type | URL | | - | - | | API Server | `https://your.domain.com/api` | | Identity Server | `https://your.domain.com/identity` | If you're unsure which region you're on, check your Bitwarden sign-in URL. US users typically sign in at `vault.bitwarden.com`, while EU users sign in at `vault.bitwarden.eu`. ## Step 3: Add the Integration in Wirespeed 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Search for and select **Bitwarden** 3. Enter the following information: * **API Server URL**: The API server URL from Step 2 * **Identity Server URL**: The identity server URL from Step 2 * **Client ID**: The client\_id from Step 1 * **Client Secret**: The client\_secret from Step 1 4. Click **Integrate** to complete the setup ## What Events Are Collected? ### User Events Authentication and account-related events: * Successful and failed login attempts * Password changes * Two-step login enable/disable * Account recovery events * Device approval requests ### Item Events Vault item activity: * Item creation, editing, and deletion * Viewing passwords, hidden fields, and security codes * Copying credentials * Autofill usage * Attachment management ### Collection & Group Events Organizational structure changes: * Collection creation, editing, and deletion * Group management ### Organization Events Administrative actions: * User invitations, confirmations, and removals * Role and group assignments * SSO configuration changes * Policy modifications * Organization settings updates * Vault exports and purges ### Secrets Manager Events For organizations using Bitwarden Secrets Manager: * Secret access, creation, editing, and deletion * Project management * Machine account changes ## Troubleshooting ### Authentication Errors If you see authentication errors: 1. Verify your client\_id and client\_secret are correct 2. Ensure you're using the correct API and Identity server URLs for your region/hosting 3. Check that your API key hasn't been rotated since setup ### No Events Appearing If events aren't showing up: 1. Events may take a few minutes to appear after initial setup 2. Verify that activity is occurring in your Bitwarden organization 3. Ensure your organization has an active Teams or Enterprise subscription ### Rate Limiting The Bitwarden Public API has rate limits. If you encounter rate limiting: 1. Wirespeed will automatically retry with exponential backoff 2. Events will be collected on the next sync cycle ## Additional Resources * [Bitwarden Public API Documentation](https://bitwarden.com/help/public-api/) * [Bitwarden Event Logs](https://bitwarden.com/help/event-logs/) * [Bitwarden API Specification](https://bitwarden.com/help/api/) # Box Source: https://docs.wirespeed.co/integrations/box Integrate with Box.com We support Box.com integrations to ingest and store all Box.com [Enterprise Events](https://developer.box.com/guides/events/). They will be available in our data lake for analysis. To get started, in Wirespeed go to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Box and select Integrate. # Check Point Firewall (Quantum) Source: https://docs.wirespeed.co/integrations/checkpoint-firewall Integrate with Check Point Firewall We currently only support Check Point Firewall. Open a support ticket if you would like integrations with additional modules. ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Check Point Firewall** and open **Forwarder Details** 2. Configure remote syslog in Gaia using either method below, with the IP and listener port from **Forwarder Details** 1. **GUI**: In [Gaia Portal](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/System-Logging-Gaia-Portal.htm?Highlight=syslog), go to System Management > System Logging > Remote System Logging, click Add, set the Wirespeed IP and severity, and click OK 2. **CLI**: In [Gaia Clish](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/System-Logging-Gaia-Clish.htm?Highlight=syslog), run `add syslog log-remote-address level ` and `save config` 3. Events will begin showing up shortly # Check Point Harmony (Avanan) Source: https://docs.wirespeed.co/integrations/checkpoint-harmony Integrate with Check Point Harmony We currently only support Check Point Harmony Email & Collaboration. Open a support ticket if you would like integrations with additional modules. Anomaly events are not supported as Check Point's API does not expose a way to fetch their details. ## If using Check Point Harmony: 1. Login to your Check Point Harmony portal 2. Click the **settings** icon in the top middle > **API Keys** 3. **New** > **New Account API Key** 1. **Service**: Email & Collaboration 2. **Expiration**: Optional, if set, make sure to set a remind for rotation. 3. **Name**: Wirespeed 4. Create 5. In Wirespeed, navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Check Point Harmony 6. Copy the information from step 4 and provide to Wirespeed 7. Do **not** select the Avanan checkbox 8. Select **Integrate** ## If using legacy Avanan Portal: 1. Open a support ticket with **Avanan** asking to get API credentials for the tenant you want access to. These must be tenant-specific credentials, not MSP credentials. 2. Download and unzip the file they provide you 3. In Wirespeed, navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Check Point Harmony 4. Copy the information from step 2 and provide to Wirespeed 5. Select the **Avanan** checkbox 6. Select **Integrate** On first sync, Wirespeed fetches detections from the last **1 hour**. # Cisco ASA Source: https://docs.wirespeed.co/integrations/cisco-asa Forward syslog events from Cisco ASA and Secure Firewall ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Cisco ASA** and open **Forwarder Details** (or ask Chat for the listener `ip:port`) 2. On the ASA, point syslog at the Wirespeed listener. Use `udp` or `tcp` to match the transport shown in **Forwarder Details**: ```text theme={null} logging enable logging timestamp rfc5424 logging trap informational logging host udp/ ``` 3. When using TCP, also run `logging permit-hostdown`. Without it, the ASA stops passing new connections while the TCP syslog server is unreachable 4. Save the configuration with `write memory` 5. Events will begin showing up shortly If **Forwarder Details** shows **TLS: Enabled**, the ASA must trust Wirespeed's certificate before it can connect. Import the root CA as a trustpoint by following [Syslog over TLS](/integrations/log-forwarders#syslog-over-tls). ## Time zones `logging timestamp rfc5424` sends timestamps with their time zone. Without it, the ASA sends local time with no time zone, and Wirespeed reads it as UTC. If the ASA clock is not set to UTC, event times will be off by the ASA's UTC offset. ## Parsed events Wirespeed parses connection builds and teardowns, NAT translations, access-list and access-group denies, device logins, AAA results, AnyConnect and WebVPN sessions, configuration commands, FQDN object resolution, and threat-detection events into dedicated fields. Every other message is stored with its message ID and text. # Cisco Catalyst Source: https://docs.wirespeed.co/integrations/cisco-catalyst Forward Cisco Catalyst logs to Wirespeed ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Cisco Catalyst** and open **Forwarder Details** 2. Configure your Cisco Catalyst device to forward syslog to the IP and listener port shown there 3. Events will begin showing up shortly # Cisco Duo Source: https://docs.wirespeed.co/integrations/cisco-duo Sync users, ingest authentication and activity logs, and remediate users from Cisco Duo ## Features * **User Directory Sync** - Automatically sync users from Cisco Duo * **Authentication Logs** - Ingest MFA authentication events for threat detection * **Activity Logs** - Ingest administrator and system activity events (create, update, delete actions) * **User Remediation** - Disable compromised users directly from Wirespeed ## Setup Instructions 1. Login to **Cisco Duo Admin Panel** 2. Click on **Applications** on the left nav and select **Application Catalog** 3. Search for **Admin API** and click **+Add** 4. Name your application **Wirespeed** 5. Enable the following permissions: * **Grant read log** - Required for authentication log ingestion * **Grant read resource** - Required for user directory sync * **Grant write resource** - Required for user remediation (disable/enable users) 6. Copy the **Integration Key**, **Secret Key**, and **API Hostname** 7. Click **Save changes** 8. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 9. Select Cisco Duo and click **Integrate** 10. Input the **Integration Key**, **Secret Key**, and **API Hostname** ## Capabilities | Capability | Description | Required Permission | | - | - | - | | User Sync | Sync users from Duo directory | Grant read resource | | Authentication Logs | Ingest MFA authentication events | Grant read log | | Activity Logs | Ingest administrator and system actions | Grant read log | | Remediate User | Disable a user to prevent authentication | Grant write resource | | Release User | Re-enable a previously disabled user | Grant write resource | There is a two minute delay in log publishing enforced by Duo # Cisco Meraki Source: https://docs.wirespeed.co/integrations/cisco-meraki Forward Cisco Meraki logs to Wirespeed If you want to add multiple Cisco Meraki organizations, you only need one Wirespeed integration. Reuse the same **Forwarder Details** for all of your Meraki instances. ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Cisco Meraki** and open **Forwarder Details** 2. Login to Cisco Meraki 3. Navigate to **Network Wide** > **Configure** > **General** 4. In the **Reporting** section select **Add a syslog server** 1. **Server IP**: Wirespeed-provided IP 2. **Port**: Wirespeed-provided port 3. **Roles** 1. Flows 2. URLs 3. WAN appliance event log 5. Click **Update Syslog Servers** to save the syslog server changes 6. **Save changes** Meraki logs should reflect shortly underneath the Events page. Cisco Meraki defaults to sending traffic unencrypted to our servers. If you would like to enable TLS, they require you to configure it via this API endpoint. After configuring, provide Wirespeed with the associated TLS certificate and we will enable TLS on our end.

DHCP events are not currently ingested Note: Coalition's claims data shows that companies using SSL VPN solutions have a significantly higher frequency of breaches and claims. Using Wirespeed helps reduce this risk substantially, but it remains important to ensure that MFA is enforced for all users and to patch devices promptly when new security issues are reported. We strongly recommend signing up for a premium Coalition Control account so you can be kept aware of new vulnerabilities in these devices. # Cisco Secure Access Source: https://docs.wirespeed.co/integrations/cisco-secure-access Ingest DNS, Proxy, and ZTNA logs from Cisco Secure Access View Cisco's documentation for configuring this integration [here](https://securitydocs.cisco.com/docs/csa/olh/121202.dita), or follow the steps below: 1. Login to [Cisco Secure Access](https://login.sse.cisco.com/) 2. Select Admin > **Log Management** 3. Navigate to **Amazon S3**, and then choose **Use a Cisco-managed Amazon S3 bucket**. 1. Set **Data Retention** to **7 days** 2. Set **Region** to **us-west-2** 4. Save the data path and AWS keys 5. In Wirespeed, navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > **Cisco Secure Access** and provide the information from step 4 Cisco publishes logs every 10 minutes, so there is approximately a 10 minute delay until events show up in Wirespeed. # Cisco Umbrella Source: https://docs.wirespeed.co/integrations/cisco-umbrella Ingest DNS records from Cisco Umbrella View Cisco's documentation for configuring this integration [here](https://docs.umbrella.com/deployment-umbrella/docs/cisco-managed-s3-bucket), or follow the steps below: 1. Login to [Cisco Umbrella](https://login.umbrella.com/) 1. If you are an MSSP or Service Provider, login to your Umbrella Dashboard > Customer Management > Select the customer you want to integrate 2. Select Admin > **Log Management** 3. Select **Use a Cisco-managed Amazon S3 bucket** 1. Set **data retention** to **7 days** 2. Set **region** to **us-west-1** 4. Save the data path and AWS keys 5. In Wirespeed, navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Cisco Umbrella and provide the information from step 4 After adding the integration, it typically takes 5-10 minutes for Cisco to start publishing data. Proxy logs from Cisco Umbrella are not currently supported

Cisco publishes DNS events every 10 minutes, so there is approximately a 10 minute delay until events show up in Wirespeed. # ConnectWise PSA Source: https://docs.wirespeed.co/integrations/connectwise-psa Automate your MSSP interactions with Wirespeed and ConnectWise Wirespeed integrates with ConnectWise (CW) PSA to automatically push escalated cases from Wirespeed into CW, as well as bi-directionally sync statuses and SLAs. ## Getting Started Login to CW to complete the following steps: ### Create a Security Role 1. Navigate to System > **Security Roles** > Hit the + button 2. Name the Role **Wirespeed** 3. Add the following permissions 1. **Companies** 1. Set Company Maintenance - **Inquire** - All 2. **Service Desk** 1. Set Close Service Tickets - **Add/Edit/Inquire** - All 2. Set Service Tickets - **Add/Edit/Inquire** - All 3. **System** 1. Select **customize** next to Table setup 2. Disallow all items 3. Allow *Service/Priority* 4. Allow *Service/Service Board* 5. Set Table setup - **Inquire** - All 6. Set Callback Entry - **Add/Delete/Inquire** - All ### Create an API Member 1. Navigate to System > Members > **API Members** > Hit the + button 2. Name the Member **Wirespeed**, similar for other required fields 3. Select the Wirespeed **Role ID** 4. Provide any other required fields as they fit your organization and **Save** 5. Select the **API Keys** tab > Hit the + button 6. Provide **Wirespeed** as the description and **Save** 7. Save the **public key** and **private key** ### Add Integration 1. Login to Wirespeed and navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Connectwise PSA 2. Provide the **URL** of the ConnectWise domain you use, e.g. [https://connectwisedev.com/](https://connectwisedev.com/) 3. Provide the **Company ID** you use to login to ConnectWise with 4. Provide the **public key** and **private key** from earlier steps 5. Save ## Configuration After adding, Wirespeed will redirect you to the configuration screen. Here you will be able to choose what Company, Board, and Ticket Type Wirespeed should use when creating tickets in ConnectWise. Additionally, you can choose what statuses and priorities to use in certain scenarios. Once a Company is selected, you can also pick one of that Company's **Sites**. Choosing a Site is optional. When one is set, Wirespeed assigns it to every ticket it creates; leaving the field on **No site** creates tickets without one. Changing the Company clears the selected Site. ## Webhook (Callback) Setup ConnectWise-to-Wirespeed sync (closing a case when its ticket is closed, and syncing responded-at SLAs) requires a callback registered for each ticket. **You do not need to configure this manually.** When Wirespeed creates a ConnectWise ticket for a case, it automatically registers a ConnectWise callback (ConnectWise's term for a webhook) for that ticket via the ConnectWise API. There is no webhook URL to copy from Wirespeed and no callback to create in ConnectWise's administrative settings. Wirespeed will sync the closed status and remediation SLAs from ConnectWise back into Wirespeed. Status syncing is stopped once the ticket has been closed, and the per-ticket ConnectWise callback for that ticket is removed. Reopening a ticket in CW will not reopen the associated case in Wirespeed.

Cases with multiple detections will only create a single CW ticket. Additional detections added to a case will not modify CW ticket status or priority. # CrowdStrike Source: https://docs.wirespeed.co/integrations/crowdstrike-falcon Integrate with CrowdStrike products including Falcon, NG-SIEM, and their identity platform ## Getting Started 1. Login to [https://falcon.crowdstrike.com/login/](https://falcon.crowdstrike.com/login/) 1. You may have a different portal URL depending on geolocation 2. Expand the navigation in the top left > Support and resources > **API Clients and keys** 3. Select **Create API Client** 4. Select the following scopes 1. Alerts - Read / Write 2. Hosts - Read / Write *(required for endpoint isolate and unisolate)* 3. Cases - Read / Write 4. Threat Graph - Read 5. Custom IOA Rules - Read 6. Correlation Rules - Read 7. Real Time Response (Active Responder) - Write *(required for file deletion)* 5. Create and save **Client ID**, **Client Secret**, and **Base URL** 6. Login to Wirespeed and navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Crowdstrike and provide the information from step 5. ## Detection Refresh Wirespeed automatically syncs detection state from CrowdStrike Falcon so your detections stay up to date without manual intervention. ### When Does It Run? Detection refresh runs **every 15 minutes** for all escalated detections that are actively being worked. Specifically, detections must meet all of the following criteria to be refreshed: * The detection was **escalated** at some point * The current status is one of: **Chat Ops**, **Hunting**, **Monitoring**, or **Escalated** * The detection was created within the **last 14 days** Refresh also runs during **case creation** to pull in the latest notes and logs from CrowdStrike before a case is opened. ### What Gets Updated? Each refresh pulls the current alert state from the CrowdStrike API and checks for changes: * **Status & Verdict** — If CrowdStrike marks a detection as a false positive (via tags, resolution, or automated triage), Wirespeed automatically closes the detection as benign. True positive confirmations are logged. * **Falcon Complete** — If the detection is assigned to CrowdStrike Falcon Complete, a note and log are added indicating Falcon Complete is managing the detection. * **Notes** — Comments from CrowdStrike are synced as notes on the detection. Notes flagged for the case are merged into any associated case. * **Assignee** — If the alert has an assignee in CrowdStrike, it is recorded on the detection. On first sync, Wirespeed fetches detections from up to the last **90 days**, capped at the newest **5,000** detections. ## Endpoint Remediation Wirespeed can network-isolate and lift containment on CrowdStrike Falcon hosts through the Falcon **PerformActionV2** API (`contain` and `lift_containment` actions). * **Isolate Endpoint** — applies network containment to the host agent ID (`device_id`) stored on the endpoint. * **Unisolate Endpoint** — lifts network containment on the same host agent ID. These actions require the **Hosts: Write** API scope in addition to **Hosts: Read**. # Idira (formerly CyberArk) Source: https://docs.wirespeed.co/integrations/cyberark Ingest audit events and sync users from Idira (formerly CyberArk) Privilege Cloud and Identity ## Overview Wirespeed connects to CyberArk Identity Security Platform Shared Services (ISPSS) to: * **Sync users** from both CyberArk Privilege Cloud (vault accounts) and CyberArk Identity (federated directory users). * **Ingest audit events** from PAM (Privilege Cloud), IDP (Identity), and ADM (Admin) services as logs, with high-signal events (auth failures, unauthorized access, MFA risk checks) also ingested as detections. * **Remediate users** via Privilege Cloud (disable / enable / terminate PSM sessions) and Identity Administration (lock / unlock / terminate SSO sessions), automatically routed based on which population the user came from. This integration is in **Beta**. Remediation actions are implemented but disabled until the integration is promoted to GA. ## Prerequisites You will need: * A **CyberArk Identity Security Platform Shared Services (ISPSS)** tenant with Privilege Cloud, Identity, and/or Admin services enabled. * Permission to create OAuth2 web apps and service users in **Identity Administration**. * Permission to create a **SIEM integration entry** in the Privilege Cloud Administration space. CyberArk tenants only allow up to **two SIEM integrations** at a time. Wirespeed consumes one slot. ## Setup The setup involves four pieces in your CyberArk tenant: 1. A service user to authenticate as. 2. Two role assignments for that service user (one for Privilege Cloud, one for Identity Administration). 3. One OAuth2 Server web app (used only for the audit/SIEM stream). 4. A SIEM integration entry to mint an API key. Follow the steps below in order. ### Step 1 — Create the service user 1. Sign in to **Identity Administration** as an administrator. 2. Go to **Core Services → Users** and click **Add User**. 3. Fill in the user's details. Set the username to something memorable, e.g. `wirespeed-svc@`. The `@` suffix is appended automatically. 4. Under **Status**, check: * **Is Service User** * **Is OAuth confidential client** * **Password never expires** 5. Click **Create User**. Note the username and password — you will need them later. ### Step 2 — Assign roles to the service user The service user needs two role assignments — one to manage Identity directory operations and one to access Privilege Cloud APIs. #### 2a. Identity Administration role 1. Go to **Core Services → Roles** and click **Add Role**. 2. Name it (e.g. `Wirespeed Integration`). 3. On the **Administrative Rights** tab, add: * **User Management** — required for syncing and locking Identity directory users. * **Report Management** — required for the Redrock query that pulls federated directory users (`DsUsers`). 4. On the **Members** tab, add the service user. 5. Click **Save**. #### 2b. Privilege Cloud admin role 1. In Identity Administration, find the built-in **Privilege Cloud Administrators** role (or any role that grants the equivalent rights — see CyberArk's [Privilege Cloud roles documentation](https://docs.cyberark.com/identity-administration/latest/en/content/coreservices/getstarted/ispss-user-roles.htm)). 2. On the **Members** tab, add the service user. 3. Click **Save**. The Privilege Cloud role assignment is **required** for the integration to call PasswordVault APIs. Without it, the platform token Wirespeed mints will be rejected with 401 by the PasswordVault endpoints. ### Step 3 — Create the audit OAuth2 web app (Server template) This app is used only for the SIEM Audit API. All other Wirespeed API calls use a generic platform token, which doesn't require a custom web app. 1. Go to **Apps & Widgets → Web Apps** and click **Add Web Apps**. 2. On the **Custom** tab, find **OAuth2 Server**, click **Add**, and confirm. 3. On the **Settings** tab, set: * **Application ID**: `WirespeedAudit` (or any URL-safe identifier — note it for later). * **Application Name**: `Wirespeed Audit`. 4. On the **General Usage** tab, set **Client ID Type** to **Confidential**. 5. On the **Tokens** tab, set: * **Token Type**: **JwtRS256**. * **Auth Methods**: enable **Client Creds**. * **Token Lifetime**: at least 15 minutes. 6. On the **Scope** tab, click **Add** and create one scope: * **Name**: `isp.audit.events:read` 7. On the **Advanced** tab, paste this script and **Save**: ```js theme={null} setClaim('tenant_id', TenantData.Get("CybrTenantID")); setClaim('aud', 'cyberark.isp.audit'); ``` 8. On the **Permissions** tab, add the service user from Step 1 with **Run**, **View**, **Grant**, and **Automatically Deploy** permissions. 9. Click **Save** at the top. ### Step 4 — Create the SIEM integration entry 1. Switch to the **Administration** space (the tenant-level admin portal). 2. Go to **My environment → Integrations → Export to SIEM**. 3. Click **Create → Create SIEM integration**. 4. Give it a name (e.g. `Wirespeed`) and click **Apply**. 5. Note the **API key** that's generated — it's only shown once. The page also displays an **API base URL**; you generally don't need to copy it (Wirespeed derives it from the platform token), but keep it handy in case auto-derivation doesn't work for your tenant. ### Step 5 — Connect Wirespeed 1. In Wirespeed, go to **Integrations → Add Integration → Idira (formerly CyberArk)**. 2. Acknowledge the Beta notice. 3. Provide: | Field | Value | | - | - | | **Identity URL** | Your Identity Admin URL, e.g. `https://aab1234.id.cyberark.cloud` (copy from the address bar of the Identity Admin portal). | | **Audit OAuth2 Server App ID** | The Application ID from Step 3 (e.g. `WirespeedAudit`). | | **Service User Login** | The full login from Step 1, including the tenant suffix (e.g. `wirespeed-svc@aab1234`). | | **Service User Password** | The password from Step 1. | | **SIEM API Key** | The API key from Step 4. | 4. Click **Add**. Wirespeed mints a platform token, derives your Privilege Cloud subdomain from it, and kicks off the first audit + user sync. The **Privilege Cloud subdomain** is auto-derived from the platform token on first connect and used to construct both the PasswordVault URL (`.privilegecloud.cyberark.cloud`) and the audit URL (`.audit.cyberark.cloud`). If your tenant uses a non-standard audit URL (e.g. region-shared hosts like `eu.audit.cyberark.cloud`), set the **Audit API Base URL** override manually in the integration's advanced options. ## What gets ingested ### Users (daily at 14:00 UTC, plus immediately on connect) Wirespeed syncs from **both** CyberArk user populations because they're distinct sets with different remediation paths: | Source | Population | Remediation surface | | - | - | - | | **PasswordVault** (`pcloud:` prefix) | Vault accounts that can hold privileged credentials, retrieve passwords, and start PSM sessions. | PasswordVault APIs (vault disable/enable, PSM live-session termination). | | **Identity directory** (`ds:` prefix) | Federated AD/LDAP/AzureAD users who authenticate to the tenant via SSO. May or may not be vault users. | Identity Administration APIs (UserMgmt lock/unlock, SSO session termination). | Each user's `directoryId` is prefixed with the source (`pcloud:17`, `ds:a41ca4c8-…`) so the remediation actions know which API to call. A single human may appear once under each prefix if they exist in both populations. Component users (CPM, PSM, ENE, etc.) are filtered out of the PCloud sync — only real human and service accounts are surfaced. ### Audit logs (every minute) Wirespeed polls the SIEM Audit API for events under three application codes: * **PAM** — Privilege Cloud (vault auth, credential access, privileged sessions, credential rotation, safe management). * **IDP** — Identity (auth, MFA, logout, SAML, risk checks). * **ADM** — Admin (access control, user management, configuration changes). On first connection, Wirespeed backfills the **last 7 days** of events (the audit stream's retention window). After that, each poll opens a new `createQuery` time window from a stored start watermark through now, and uses `cursorRef` only to page within that window. ### Detections A subset of high-signal events are also ingested as detections and routed through Wirespeed's verdict / monitor pipeline: | CyberArk event | OCSF detection class | Severity | | - | - | - | | PAM auth failure (PAM00004) | DetectionFinding | Medium | | PAM logon failed — disabled / expired (PAM00102-104) | DetectionFinding | Medium | | PAM unauthorized password use (PAM00306-307) | DetectionFinding | High | | PAM unauthorized safe operations (PAM00017, 00025-026, 00040-047) | DetectionFinding | High | | Identity MFA failure (`Cloud.Core.MfaSummary` with `MfaResult: failure`) | DetectionFinding | Medium | | Identity Adaptive MFA risk check (`Cloud.Core.AdaptiveMfa.RiskCheck`) | DetectionFinding | Medium | All other events flow as logs only. ## Remediation While the integration is in Beta, all remediation actions return an error indicating remediation is not yet enabled. Once promoted to GA, the following actions become available: | Action | Vault user (`pcloud:`) | Directory user (`ds:`) | | - | - | - | | **Disable User** | `POST /PasswordVault/API/Users/{id}/disable/` | `POST /UserMgmt/ChangeUserAttributes` with `LockedByAdmin: true` | | **Enable User** | `POST /PasswordVault/API/Users/{id}/enable/` | `POST /UserMgmt/ChangeUserAttributes` with `LockedByAdmin: false` | | **Revoke User Sessions** | Look up username, search `LiveSessions`, `POST .../Terminate/` for each PSM session | `POST /Security/EndUserSessions` (terminates SSO sessions) | The **Revoke User Sessions** action requires additional Privilege Cloud configuration: * `AllowPSMNotifications` must be set to **Yes** in PVWA configuration. * The service user must be a member of the **Terminating Live Sessions Users and Groups** group in PVWA. ## Limits and caveats * **Audit stream retention**: 7 days. If Wirespeed can't poll for longer than that (e.g. extended outage), the gap is unrecoverable. * **Audit stream rate limit**: 1 API call per minute per integration. Wirespeed polls on a 1-minute cron and respects this. * **PasswordVault user list**: capped at 6,000 users in a single response. Larger vault tenants would currently be truncated. * **SIEM integrations per tenant**: 2. Wirespeed consumes one. * **Service user credentials**: rotate the service user's password in Identity Administration, then update it in the Wirespeed integration settings. * **PSM live-session termination** requires `AllowPSMNotifications=Yes` in PVWA and the service user to be in the **Terminating Live Sessions Users and Groups** vault config group. Without that, only SSO-side session termination works (still effective for blocking new privileged sessions). ## Troubleshooting If you see authentication errors after setup, the most common causes are: | Symptom | Likely cause | | - | - | | `invalid_scope` on audit token mint | The `isp.audit.events:read` scope on the audit OAuth app's Scope tab doesn't exactly match (case- and punctuation-sensitive). | | Audit token mints but audit API calls 401 | The `aud` / `tenant_id` claims script (Step 3.7) wasn't saved, or the service user is missing **Run** permission on the audit OAuth app. | | Audit calls 401 even with the right token | The `x-api-key` header is missing or wrong. | | User sync returns no users / 401 | The service user is not assigned to a Privilege Cloud admin role (Step 2b), or the auto-derived subdomain is wrong — set `pcloudSubdomain` manually in the integration's advanced options. | | Audit calls fail with DNS errors / 404 | Auto-derived audit URL `.audit.cyberark.cloud` is wrong for your tenant. Set `auditApiBaseUrl` manually in advanced options to the URL shown on the SIEM integration page. | | Remediation actions return "not yet enabled" | The integration is still in Beta. Contact your Wirespeed account team to promote to GA. | | Revoke Sessions returns 403 | The service user is not a member of the **Terminating Live Sessions Users and Groups** group, or `AllowPSMNotifications` is not enabled. | # Darktrace Source: https://docs.wirespeed.co/integrations/darktrace Ingest AI-powered network detections from Darktrace Darktrace uses webhooks to forward Cyber AI Analyst and model breach alerts to Wirespeed in real-time. ## Prerequisites * A Darktrace appliance with access to the Threat Visualizer * Network connectivity from Darktrace to `https://api.wirespeed.co` ## Setup in Wirespeed 1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Darktrace** 2. Select **Webhook Details** 3. Copy the **Webhook URL** and **Webhook Secret** — you'll need these for the Darktrace configuration ## Setup in Darktrace 1. Login to **Darktrace Threat Visualizer** 2. Navigate to **Modules** 3. Select **HTTPS** 4. Click **Workflow Integrations** 5. Enable the integration and select the devices or subnets you want to monitor ### Configure HTTP/HTTPS Alerts 1. In the **Configuration for HTTP/HTTPS Alerts** section, click **New** to create a new alert configuration 2. Toggle **Send Alerts** to enabled 3. In the **URL** field, paste the **Webhook URL** from Wirespeed 4. Toggle **Show Advanced Options** to expand authentication settings 5. Set **Authentication** to **Basic** 6. Enter `wirespeed` as the **Username** 7. Enter the **Webhook Secret** from Wirespeed as the **Password** 8. Click **Verify alert settings** to test the connection 9. Save your configuration ## What Gets Ingested Wirespeed receives and processes the following from Darktrace: * **Cyber AI Analyst Incidents** — AI-generated investigation summaries * **Model Breaches** — Behavioral detections from Darktrace's unsupervised ML models Each detection is automatically enriched with device context and triaged using Wirespeed's verdict system. ## Troubleshooting Ensure your Darktrace appliance can reach `https://api.wirespeed.co` on port 443. Check firewall rules and proxy settings. Verify that **Send Alerts** is enabled and that the devices you want to monitor are selected in the Workflow Integrations panel. Double-check that **Basic** authentication is selected, the username is exactly `wirespeed`, and the password matches your Webhook Secret from Wirespeed. # DFIR IRIS Source: https://docs.wirespeed.co/integrations/dfir-iris Integrate with DFIR IRIS for incident response case management DFIR IRIS integration documentation is coming soon. You can express interest from [Integrations → View all](https://app.wirespeed.co/settings/integrations?tab=browse\&status=coming-soon). # Email Source: https://docs.wirespeed.co/integrations/email Integrate with Email We support Email integrations to communicate with your security team and end users. The emails come from our infrastructure and require no additional work to get set up. When creating the integration you will be asked to provide an email, this email is used for critical security escalations or those where no specific end user is identified. To get started, [add a new integration](https://app.wirespeed.co/settings/integrations?tab=browse) and select Email. Want emails to come from your own domain? Use the [Custom SMTP](/integrations/smtp) integration instead. When Custom SMTP is installed, it automatically replaces this integration for all ChatOps communications. # Exium Source: https://docs.wirespeed.co/integrations/exium Ingest Syslog logs from Exium ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Exium** and open **Forwarder Details** 2. Configure your Exium device to forward syslog to the IP and listener port shown there 3. Events will begin showing up shortly # Fleet Source: https://docs.wirespeed.co/integrations/fleet-dm Sync Fleet host inventory and activity telemetry Fleet is an osquery-based device management platform. Wirespeed connects to your Fleet server (self-hosted or Fleet Cloud) using an API token to sync host inventory and the activity feed for asset correlation. ## Prerequisites * A Fleet server URL, e.g. `https://fleet.yourcompany.com` (self-hosted) or `https://.fleetdm.com` (cloud) * A Fleet **API-only user** with the **Observer** role (read-only access is all Wirespeed needs). Fleet recommends API-only users for automated workflows because their API keys do not expire like regular user keys. ## Create an API Token 1. In Fleet, create an API-only user with the **Observer** role from **Settings** > **Users** > **Create user** > **API-only**. 2. You can also create the API-only user with `fleetctl`: ```bash theme={null} fleetctl user create --name "Wirespeed" --email "[email protected]" --api-only --global-role observer ``` 3. Copy the generated **API token** when Fleet displays it and store it securely. ## Add the Integration in Wirespeed 1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Fleet** 2. Enter your **Fleet URL** and the **API token** 3. Submit the integration ## What Wirespeed Ingests | Source | Fleet API | Purpose | | - | - | - | | Hosts | `GET /api/v1/fleet/hosts` | Managed device inventory for asset correlation | | Activities | `GET /api/v1/fleet/activities` | Audit/activity telemetry | # Fortinet Source: https://docs.wirespeed.co/integrations/fortinet Ingest firewall logs from Fortinet ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Fortinet** and open **Forwarder Details** 2. Login to your Fortinet instance 3. Configure syslog forwarding using one of the methods below ## GUI configuration Use this method when your FortiGate UI lets you specify both the syslog server address and port. 1. Go to Settings > Log & Report > Log Settings 2. Click the Syslog Server tab 3. Click **Add** to display the configuration dialog 4. Provide the IP and listener port from **Forwarder Details** 5. Click **Apply** [Fortinet GUI documentation reference](https://community.fortinet.com/t5/FortiADC/Technical-Tip-How-to-configure-Syslog-Server-on-FortiADC/ta-p/189522) ## CLI configuration (recommended when a custom port is not available in the UI) Some FortiGate models and firmware versions do not let you specify a custom syslog port in the web UI. The GUI may only support forwarding to port **514** (the default syslog port), which is not the port Wirespeed assigns. Use the FortiGate CLI to forward syslog to the **IP address and port** from **Forwarder Details**. **We recommend the CLI path whenever the UI cannot target your Wirespeed-assigned port.** 1. Connect to your FortiGate via SSH or the CLI console 2. Run the following commands, replacing `` and `` with the values from **Forwarder Details**: ```text theme={null} config log syslogd setting set status enable set server "" set mode udp set port end ``` 1. If your FortiGate must send syslog from a specific source IP, add `set source-ip ""` before `end` 2. If `syslogd` is already in use, repeat the commands with `syslogd2`, `syslogd3`, or `syslogd4` instead. FortiGate supports up to four syslog destinations. [Fortinet CLI reference: `config log syslogd setting`](https://docs.fortinet.com/document/fortigate/8.0.0/cli-reference/141516630/config-log-syslogd-setting) Note: Coalition's claims data shows that companies using SSL VPN solutions have a significantly higher frequency of breaches and claims. Using Wirespeed helps reduce this risk substantially, but it remains important to ensure that MFA is enforced for all users and to patch devices promptly when new security issues are reported. We strongly recommend signing up for a premium Coalition Control account so you can be kept aware of new vulnerabilities in these devices. # Fortinet FortiAnalyzer Source: https://docs.wirespeed.co/integrations/fortinet-fortianalyzer Ingest firewall logs from FortiAnalyzer **FortiAnalyzer Cloud** may not support **Log Forwarding**. Confirm whether your product edition and firmware version include this feature in [Fortinet’s FortiAnalyzer Cloud documentation](https://docs.fortinet.com/product/fortianalyzer-cloud/7.6), choosing the documentation release that matches your deployment. ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **FortiAnalyzer** and open **Forwarder Details** 2. Login to your FortiAnalyzer instance 3. Go to System Settings > Advanced > Log Forwarding > Settings 4. Click **Create New** in the toolbar 5. Provide the required information with the below options 1. **Remote Server Type**: Syslog 2. **Server FQDN/IP**: From **Forwarder Details** 3. **Server Port**: From **Forwarder Details** 6. Click **OK** [Fortinet documentation reference](https://docs.fortinet.com/document/fortianalyzer/7.6.2/administration-guide/19991/configuring-log-forwarding) Forwarding directly from FortiGate appliances instead of FortiAnalyzer? See the [Fortinet integration](/integrations/fortinet) guide — especially the [CLI configuration](/integrations/fortinet#cli-configuration-recommended-when-a-custom-port-is-not-available-in-the-ui) section when the FortiGate UI cannot target your Wirespeed-assigned port. # Freshservice Source: https://docs.wirespeed.co/integrations/freshservice Create and sync Freshservice tickets from Wirespeed cases and detections Connect Wirespeed to Freshservice to automatically create ITSM tickets when cases are escalated, and optionally for standalone closed detections. ## Setup 1. In Wirespeed, go to **Settings → Integrations → Add Integration → Freshservice**. 2. Enter your Freshservice domain (for example `yourcompany.freshservice.com`) and API key. 3. Open the integration configuration and set: * **Ticket Requester Email** — required; must be the email of an existing Freshservice agent or requester * **Workspace / Client** — optional for single-workspace accounts; required for MSP-style deployments * **Assignment Group** — optional queue for new tickets 4. Save configuration to enable ticket creation. ## API key Generate an API key in Freshservice under **Profile → Profile Settings**. The integration uses HTTP Basic Auth with the API key as the username and `X` as the password. If Profile Settings shows **"Your API key is disabled"**, an account admin must enable API key access for that agent first: 1. Go to **Admin → User Management → Agents** 2. Open the agent profile 3. On the **Permissions** tab, enable **API Key** 4. Return to **Profile → Profile Settings** to view or copy the key On new accounts, this permission is often disabled by default, even for the account owner. ## Ticket behavior * **Cases** — a Freshservice ticket is created when a case is escalated * **Standalone detections** — optional; enable **Create Tickets for Closed Detections** in configuration * **Updates** — when a case closes, the linked ticket is set to Closed; when detections are merged into a case, a private note is added to the ticket Freshservice **Priority Matrix** (if enabled) derives priority from impact and urgency, ignoring `priority` alone. Wirespeed sets all three from case severity. To use only the `priority` field, disable Priority Matrix under **Admin → Priority Matrix**. ## Permissions The API key must belong to an agent with permission to create and update tickets. # Generic JSON Logs Source: https://docs.wirespeed.co/integrations/generic-json Ingest JSON logs from any source within your organization Wirespeed can ingest JSON logs from any source within your organization. Email addresses, IPs, and important dates are automatically identified and extracted. If you would like additional information extracted, use **Chat** on the left-hand navigation. ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Generic JSON** and open **Forwarder Details** 2. Configure your source to POST JSON to the HTTP or HTTPS listener shown there 3. Choose **HTTP body format** on the integration: * **JSON object or array** — one JSON value per request (pretty-printed objects are fine; a root array becomes one event per element) * **Newline-delimited JSON (NDJSON)** — one JSON object per line 4. Events will begin showing up shortly # Generic Syslog Logs Source: https://docs.wirespeed.co/integrations/generic-syslog Ingest Syslog logs from any source within your organization Wirespeed can ingest Syslog logs from any source within your organization. Email addresses, IPs, and important dates are automatically identified and extracted. If you would like additional information extracted, use **Chat** on the left-hand navigation. ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Generic Syslog** and open **Forwarder Details** 2. Configure your source to forward syslog to the IP and listener port shown there 3. Events will begin showing up shortly ### Appliances that cannot use a custom syslog port in the UI Some appliances — notably FortiGate firewalls — do not let you specify a custom syslog port in the web UI. The GUI may only expose port **514**, while Wirespeed assigns a dedicated port for your integration. For FortiGate, configure syslog through the CLI using your Wirespeed-assigned port. See the [Fortinet integration](/integrations/fortinet#cli-configuration-recommended-when-a-custom-port-is-not-available-in-the-ui) guide. # GitHub Source: https://docs.wirespeed.co/integrations/github Receive security events from GitHub Team and Free organizations This integration covers GitHub Team and Free organizations with real-time GitHub App webhooks. GitHub Enterprise Cloud customers should use the [GitHub Enterprise Cloud integration](/integrations/github-enterprise-cloud) for organization audit-log coverage. The GitHub integration receives security-relevant changes to organization membership, repositories, branch protection, deploy keys, and GitHub security alerts. Wirespeed indexes users and repositories for investigation and runs managed detections against the events. ## Before you connect * Have a GitHub organization owner available to complete or approve the Wirespeed GitHub App installation. * Review and accept the App's read-only organization **Members**, repository **Administration**, Dependabot, secret-scanning, and code-scanning permissions. * Choose the repositories the App should monitor. Events from repositories outside the App installation are not visible to Wirespeed. ## Connect GitHub 1. In Wirespeed, open [Settings → Integrations](https://app.wirespeed.co/settings/integrations?tab=browse) and select **GitHub**. 2. Review these instructions, then select **Integrate**. 3. In GitHub, choose the Team or Free organization to monitor. 4. Choose all repositories or select the repositories that Wirespeed should monitor, then install the App. 5. Authorize the App when GitHub prompts you. GitHub returns you to Wirespeed when the connection is ready. Repeat the connection flow for each organization that should be monitored. Deleting the Wirespeed connection does not uninstall the GitHub App. Remove the App under **Organization Settings → GitHub Apps** when the connection should stop sending events. ## Data collection Collection starts when the App is installed. GitHub webhooks do not provide historical events or backfill activity that occurred before installation. Wirespeed subscribes to: * Organization members, membership, and teams * Repository lifecycle and visibility changes * Branch protection, repository rulesets, and deploy keys * Wirespeed GitHub App lifecycle and repository access changes * Dependabot, secret-scanning, and code-scanning alerts when those GitHub features are enabled **Dependabot alerts** can be turned on for every repository under **Settings → Advanced Security**. The dependency graph must be enabled first. **Secret scanning** runs on public repositories. Public repositories can use **code scanning**, and Wirespeed receives those events only after it is set up with CodeQL default setup or a workflow. Private repositories need GitHub Secret Protection or GitHub Code Security. Without that license, Wirespeed receives no events for those features. An organization owner can enable the available features for many repositories under **Organization settings → Security → Advanced Security → Configurations**. GitHub Team and Free do not expose the Enterprise organization audit-log API. Webhooks generally do not include actor IP addresses, Git clone/access activity, SAML or organization two-factor changes, personal access token grants, or a historical backfill. ## Detections Wirespeed includes managed detections for: * Organization administrator access grants * Repositories made public or transferred * Branch protection changes * Deploy keys added to repositories * New or reopened secret-scanning alerts * High or critical code-scanning and dependency alerts # GitHub Enterprise Cloud Source: https://docs.wirespeed.co/integrations/github-enterprise-cloud Ingest organization audit events from GitHub Enterprise Cloud GitHub Team and Free organizations should use the [GitHub integration](/integrations/github), which collects the security events available through GitHub App webhooks. The GitHub Enterprise Cloud integration imports organization audit events into Wirespeed. Events include web and Git activity, such as changes to organization membership, repositories, permissions, settings, and authentication. Wirespeed indexes actor IP addresses and usernames for investigation and threat detection. ## Before you connect * Confirm the organization uses **GitHub Enterprise Cloud**, which is required for organization audit-log access. * Have a GitHub organization owner available to complete or approve the Wirespeed GitHub App installation. * Review and accept the App's read-only **Organization administration** permission. The App cannot modify repositories, organization settings, members, or code. * For IP-based investigations and detections, enable source IP disclosure under **Organization Settings → Logs → Audit log → Settings**. ## Connect GitHub Enterprise Cloud 1. In Wirespeed, open [Settings → Integrations](https://app.wirespeed.co/settings/integrations?tab=browse) and select **GitHub Enterprise Cloud**. 2. Review these instructions, then select **Integrate**. 3. In GitHub, choose the Enterprise Cloud organization you want to monitor. 4. Review the requested read-only organization permission and install the Wirespeed GitHub App. 5. Authorize the App when GitHub prompts you. GitHub returns you to Wirespeed when the connection is ready. Repeat the connection flow for each organization that should be monitored. Deleting the Wirespeed connection does not uninstall the GitHub App. To connect the same organization again, uninstall the App in GitHub (**Organization Settings → GitHub Apps**), then reconnect from Wirespeed so GitHub can run the OAuth install flow again. Wirespeed uses the authorizing user's short-lived GitHub token only to verify access to the selected installation. Polling uses a one-hour installation token that is regenerated automatically; the user's token is not retained. ## Data collection The first sync imports up to seven days of available organization audit events. Later syncs resume from the latest successfully ingested event and include both web and Git events. Source IP disclosure is disabled by default. Audit events are still ingested when it is disabled, but they do not include the actor IP address used by IP-based investigations and detections. GitHub can return **403** or **404** when the organization is not on Enterprise Cloud or the App does not have Organization administration read permission. Wirespeed reports that state on the integration rather than collecting partial audit data. ## Detections Wirespeed includes starter managed detections for organization IP allow-list changes, owner-role assignments, SAML and two-factor requirement changes, and grants of personal access tokens, OAuth Apps, or GitHub Apps. # Google Alert Center Source: https://docs.wirespeed.co/integrations/google-alert-center Integrate with Google Alert Center Google workspace requires the use of [domain-wide delegation](https://support.google.com/a/answer/162106) to access their [Alert Center API](https://developers.google.com/workspace/admin/alertcenter/reference/rest) ([additional reference](https://developers.google.com/admin-sdk/alertcenter/guides/auth#create_a_service_account)). ## 1. Granting Access To grant access for Wirespeed you can follow the instructions [here](https://support.google.com/a/answer/162106) or below: 1. Login to [https://admin.google.com](https://admin.google.com) 2. Go to Menu > Security (You may have to click "Show more") > Access and data control > API controls > Manage Domain Wide Delegation 3. Click Add New 4. Enter `110095815816827055854` as the Client ID 5. Enter `https://www.googleapis.com/auth/apps.alerts` as the OAuth Scopes 6. Click Authorize ## 2. Getting your customer ID 1. Login to [https://admin.google.com](https://admin.google.com) 2. Go to Menu > Account > Account Settings > [Profile](https://admin.google.com/ac/accountsettings/profile) 3. Copy your Customer ID ## 3. Getting your customer email Google requires an account to impersonate for using the Alert Center API. If you're reading this, your email address should be the correct value to use for this and is automatically filled in the form. Otherwise, provide an email for an administrator of your organization. ## 4. Verify the connection After you connect Google Alert Center in Wirespeed, a verification email is sent to the Google admin email you provided. The integration stays disabled until that admin completes verification: 1. Open the email and click **Review connection**. The link expires in 7 days. 2. On the confirmation page, review the Google Workspace customer ID and click **Accept and connect**. If the email did not arrive, open the integration in Settings and choose **Resend verification email**. On first sync, Wirespeed fetches alerts from the last **90 days**. # Google SecOps Source: https://docs.wirespeed.co/integrations/google-chronicle Integrate with Google Security Operations (Google Chronicle) to ingest custom and curated rule detections Wirespeed integrates with Google Chronicle SIEM to poll detections from both custom YARA-L rules and Google-curated rules, and to inventory the rules actively watching your environment. ## Prerequisites * Access to a Google Cloud project that owns your Chronicle instance * Admin permissions to create a service account and grant IAM roles * A provisioned Chronicle (Google Security Operations) instance * Your Chronicle **region** and **customer ID** * The ability to download a service account key in JSON format ## Setup Instructions ### Step 1: Create a Service Account 1. Navigate to the [Google Cloud Console](https://console.cloud.google.com/) 2. Select the **Project** that owns your Chronicle instance 3. Go to **IAM & Admin** > **Service Accounts** 4. Click **Create Service Account** 5. Enter a name (e.g., `wirespeed-chronicle-integration`) 6. Enter a description (e.g., `Service account for Wirespeed Chronicle integration`) 7. Give the service account the `Chronicle API Editor` role. 8. Click **Create and Continue** 9. Click **Done** ### Step 2: Generate and Download the Service Account Key 1. In the Service Accounts list, click on the actions and select **Manage keys** 2. Click **Add Key** > **Create new key** 3. Select **JSON** as the key type 4. Click **Create** — the JSON key file downloads automatically * **Keep this file secure** — it grants access to your Chronicle detections 5. Open the JSON file and copy the entire contents ### Step 3: Find Your Chronicle Region and Customer ID Chronicle instances are provisioned in a specific region. The region determines the API endpoint used by Wirespeed. You can find this information under Google SecOps in GCP. **Region** — your Chronicle instance lives in one of the supported regions below: * `us`, `eu`, `europe` * `africa-south1` * `asia-east1`, `asia-northeast1`, `asia-northeast3`, `asia-south1`, `asia-southeast1`, `asia-southeast2` * `australia-southeast1` * `europe-central2`, `europe-west2`, `europe-west3`, `europe-west6`, `europe-west9`, `europe-west12` * `me-central1`, `me-central2`, `me-west1` * `northamerica-northeast2` * `southamerica-east1` **Customer ID** — the GUID of your Chronicle instance. ### Step 4: Configure Wirespeed 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **Google Chronicle** 3. Enter the following: * **Region**: the Chronicle region, e.g. `us` * **Customer ID**: the GUID from Step 3 * **Service Account Key**: the complete JSON contents from Step 2 4. Click **Save** Wirespeed will validate your credentials by making an authenticated call against the configured Chronicle instance, then begin polling detections. Note that we only sync alerting detections. On first sync, Wirespeed backfills the last **7 days** of detections. All detections are ingested as informational during Phase 1. # Google Security Center Source: https://docs.wirespeed.co/integrations/google-security-center Integrate with Google Cloud Security Command Center (SCC) to ingest findings Wirespeed integrates with Google Cloud Security Command Center (SCC) to collect security findings from your Google Cloud organization. ## Prerequisites * Access to a Google Cloud organization * Google Cloud Security Command Center enabled in your organization * Organization-level permissions to grant **Security Command Center Admin Viewer** (`roles/securitycenter.adminViewer`) * One of the following authentication options: * A service account key in JSON format * A Workload Identity Federation pool/provider configured for Wirespeed's AWS role ## Setup Instructions Choose one authentication method: **Service account key** or **Workload Identity Federation**. ## Option A: Service Account Key ### Step 1: Create a Service Account in a Project 1. Navigate to the [Google Cloud Console](https://console.cloud.google.com/) 2. Select a **Project** from the project dropdown (top left) - this can be any project within your organization 3. Go to **IAM & Admin** > **Service Accounts** 4. Click **Create Service Account** 5. Enter a service account name (e.g., `wirespeed-scc-integration`) 6. Enter a description (e.g., `Service account for Wirespeed SCC integration`) 7. Click **Create and Continue** 8. Skip the optional grant project roles step (or skip for now) 9. Click **Done** ### Step 2: Generate and Download the Service Account Key 1. In the Service Accounts list, click on the service account you just created 2. Go to the **Keys** tab 3. Click **Add Key** > **Create new key** 4. Select **JSON** as the key type 5. Click **Create** 6. The JSON key file will download automatically * **Keep this file secure** - it contains credentials to access your organization's security data 7. Open the JSON file with a text editor and copy the entire contents ### Step 3: Grant Organization-Level Permissions 1. Navigate to your **Organization** level (click the organization name in the top left dropdown) 2. Go to **IAM & Admin** > **IAM** 3. Click **Grant Access** 4. In the **New principals** field, enter the service account email (found in the JSON key as `client_email`) 5. Click the **Select a role** dropdown and search for and select the following roles: * **Security Command Center Admin Viewer** (`roles/securitycenter.adminViewer`) 6. Click **Save** The service account must be granted roles at the **Organization level** (not the project level) to access findings across all projects within your organization. ### Step 4: Find Your Organization ID 1. In the Google Cloud Console, go to **IAM & Admin** > **Settings** 2. Find the **Organization ID** field at the top 3. Copy this ID ### Step 5: Configure Wirespeed 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **Google Security Center** 3. Enter the following information: * **Organization ID**: The organization ID from Step 4 * **Service Account Key**: The complete JSON contents from Step 2 4. Click **Save** Wirespeed will begin collecting detections from your Google Cloud Security Command Center. On first sync, Wirespeed fetches up to the newest **5,000** findings. ## Option B: Workload Identity Federation Use Workload Identity Federation if you want Wirespeed to authenticate without storing a long-lived Google service account key. This integration supports direct federated access from Wirespeed's AWS role. Do not configure service account impersonation for this integration. ### Step 1: Create a Workload Identity Pool 1. In the Google Cloud Console, go to **IAM & Admin** > **Workload Identity Federation**. 2. Click **Create pool**. 3. Enter a pool name, for example `wirespeed`. 4. Click **Continue**. ### Step 2: Add an AWS Provider 1. Select **AWS** as the provider type. 2. Enter a provider name, for example `wirespeed-aws`. 3. Enter Wirespeed's AWS account ID: `194722417411` 4. Configure the attribute mappings: * `google.subject=assertion.arn` * `attribute.account=assertion.account` * `attribute.aws_role=assertion.arn.extract('assumed-role/{role_name}/')` 5. Configure the attribute condition: `assertion.account=='194722417411'` 6. Save the provider. ### Step 3: Grant Security Command Center Access 1. Navigate to your **Organization** level in the Google Cloud Console. 2. Go to **IAM & Admin** > **IAM**. 3. Click **Grant Access**. 4. In the **New principals** field, enter the principal set for Wirespeed's AWS role: * `principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.aws_role/wirespeed-gcp` 5. Replace `PROJECT_NUMBER` with the numeric **Project number** shown on the [Google Cloud dashboard](https://console.cloud.google.com/home/dashboard) for the project that contains the workload identity pool. This is not the **Project ID**. 6. Replace `POOL_ID` with the workload identity pool ID, for example `wirespeed`. 7. Select **Security Command Center Admin Viewer** (`roles/securitycenter.adminViewer`). 8. Click **Save**. This role must be granted at the **Organization level** to access findings across all projects within your organization. ### Step 4: Download the Credential Configuration 1. Go back to **IAM & Admin** > **Workload Identity Federation**. 2. Open the workload identity pool and provider you created for Wirespeed. 3. Click **Grant access**. 4. Click **Download config**. 5. Choose the direct federated identity configuration for the AWS provider. 6. Download the Google credential configuration JSON. Do not select service account impersonation. The JSON should have `type: "external_account"` and must not include `service_account_impersonation_url`. ### Step 5: Find Your Organization ID 1. In the Google Cloud Console, select your **organization**, not a project. 2. Go to **IAM & Admin** > **Settings**. 3. Find the **Organization ID** field at the top. 4. Copy this ID. ### Step 6: Configure Wirespeed 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse). 2. Select **Google Security Center**. 3. Select **Workload Identity Federation** as the authentication method. 4. Enter the following information: * **Organization ID**: The organization ID from Step 5 * **Workload identity configuration**: The complete Google credential configuration JSON from Step 4 5. Click **Save**. Wirespeed will begin collecting detections from your Google Cloud Security Command Center. # Google Workspace Source: https://docs.wirespeed.co/integrations/google-workspace Integrate with Google Workspace We use Google Workspace's [OAuth](https://developers.google.com/identity/protocols/oauth2) support to integrate into your Workspace account. The workspace integration requires directory read permissions to be able to look up all users in your organization. To get started, [add a new integration](https://app.wirespeed.co/settings/integrations?tab=browse) and select Google Workspace. You will be redirected to the OAuth Consent Page. ### Allow-listing Wirespeed emails in the Google Admin Console You can add certain domains and email addresses to an allow-list across your Google Workspace. To ensure Wirespeed emails get to your team: 1. Sign in to the Google Admin Console at [https://admin.google.com](https://admin.google.com) using an administrator account. 2. In the left-hand menu, click **Apps** > **Google Workspace** > **Gmail**. 3. Ensure your domain is selected in the **Organizational Units** section. 4. On the **Spam, Phishing, and Malware** tab, locate the **Spam** section. 5. Click **Configure** (if no rules exist) or **Add another rule**. 6. Name your rule, and ensure the **Bypass spam filters and hide warnings for messages from senders or domains in selected lists** checkbox is checked. The **Bypass spam filters for internal senders** checkbox may be checked by default. It's NOT necessary to have this checked for our purposes and may add unwanted risk. Consider this before leaving it enabled. 7. Click **Create or edit list** to open the Manage Address list page. * ***If creating a new list***, click **ADD ADDRESS LIST** name it accordingly, and select **Add Address**. * ***If editing an existing list***, select the list and click **Add Address**. 8. In the field provided, enter the domain: [wirespeed.co](https://wirespeed.co). 9. Click **SAVE**. 10. Return to the spam rule configuration page and click **Use existing list** and select the list you edited. 11. Click **Save** to apply the changes. ## Errors ### access\_not\_configured Access blocked: Your institution's admin needs to review Wirespeed. Error 400: access\_not\_configured This error occurs when your Google Workspace organization restricts third-party OAuth applications by default. This is a security feature in Google's Admin Console that requires an administrator to explicitly approve applications before users can grant them access. To resolve this, a Google Workspace Super Admin must pre-approve the Wirespeed application: 1. Sign in to the [Google Admin Console](https://admin.google.com) as a Super Admin. 2. Navigate to **Security** > **Access and data control** > **API controls**. 3. Click **Manage Third-Party App Access** (or go directly to [App Access Control](https://admin.google.com/ac/owl/list?tab=apps)). 4. Click **Add app** > **OAuth App Name Or Client ID**. 5. Search for **Wirespeed** or paste the OAuth Client ID provided by your Wirespeed administrator. 6. Select the Wirespeed app and click **Select**. 7. Set the access level to **Trusted** (recommended) or **Limited**. 8. Click **Configure** to save. Once the app has been approved, return to Wirespeed and retry the [Google Workspace integration](https://app.wirespeed.co/settings/integrations?tab=browse). If you are unsure of the OAuth Client ID, contact your Wirespeed account representative or email [support@wirespeed.co](mailto:support@wirespeed.co). The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. # Halcyon Source: https://docs.wirespeed.co/integrations/halcyon Import anti-ransomware alerts, manage endpoints, and quarantine or release files from Halcyon The Halcyon integration syncs anti-ransomware alerts and endpoint data from Halcyon into Wirespeed, including: * **Ransomware detections**: Malicious executables, brute force attempts, vulnerable drivers, and more * **Artifact enrichment**: SHA256 hashes, file paths, IPs, and DNS records are automatically extracted for further enrichment * **Endpoint inventory**: Devices with the Halcyon agent installed are synced as endpoints ## Prerequisites Before setting up this integration, ensure you have: 1. A Halcyon account with **admin** privileges 2. Your Halcyon account username and password 3. Your Tenant ID (if using a multi-tenant or MSSP setup) ## Step 1: Gather Your Credentials You will need the following information from your Halcyon account: | Field | Description | | - | - | | **Username** | Your Halcyon admin account username | | **Password** | Your Halcyon admin account password | | **Tenant ID** | *(Optional)* Your Halcyon tenant UUID. Required for multi-tenant or MSSP setups. | Your credentials provide access to your Halcyon tenant. Store them securely and use an account dedicated to the Wirespeed integration when possible. ## Step 2: Add the Integration in Wirespeed 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Search for and select **Halcyon** 3. Enter your **Username**, **Password**, and optionally your **Tenant ID** 4. Click **Integrate** to complete the setup ## What Gets Synced? ### Alerts (Detections) Wirespeed ingests alerts from Halcyon. Each alert is enriched with: * **Artifacts**: File hashes (SHA256), file paths, IP addresses, and DNS records from the alert * **Assets**: Affected devices associated with the alert SHA256 hashes extracted from Halcyon artifacts are automatically enriched by other integrations like ReversingLabs when available. ### Devices (Endpoints) All devices with the Halcyon agent are synced as endpoints, including hostname, operating system, and online status. ## Troubleshooting ### Authentication Errors If you see authentication errors: 1. Verify your username and password are correct 2. Ensure your account has admin privileges 3. If using a multi-tenant setup, confirm the Tenant ID is correct ### No Alerts Appearing If alerts aren't showing up: 1. Alerts may take a few minutes to appear after initial setup 2. The initial sync pulls up to the newest 5,000 alerts 3. Verify that alerts exist in your Halcyon console ## Additional Resources * [Halcyon API Documentation](https://api.halcyon.ai/docs/index.html) On first sync, Wirespeed fetches up to the newest **5,000** alerts. # Halo ITSM Source: https://docs.wirespeed.co/integrations/halo-itsm Integrate with Halo ITSM to automatically create and manage tickets from Wirespeed cases and detections ## Prerequisites In Halo ITSM, you need an API application configured with the **Client Credentials** grant type. To create one: 1. Log in to your **Halo ITSM** instance 2. Navigate to **Configuration** > **Integrations** > **HaloPSA API** > **View Applications** 3. Click **New** to create an application 4. Set **Authentication Method** to `Client ID and Secret (Services)` 5. Set **Login Type** to **Agent** and set **Agent** to **Application Identity** 6. Under **Identity Roles**, select **IT Agent** 7. Grant the application access to the following scopes: `read:tickets`, `edit:tickets`, `read:customers` 8. Copy the **Client ID** and **Client Secret** 9. Save the application ## Connect Wirespeed to Halo ITSM 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **Halo ITSM** and click **Integrate** 3. Fill in the following fields: * **Halo Instance URL** — the base URL of your Halo instance (e.g. `https://yourcompany.halopsa.com`) * **Client ID** — from the API application created above * **Client Secret** — from the API application created above 4. Click **Save** Wirespeed will verify the credentials by checking access to Teams, Ticket Types, and Categories. If any check fails, the integration will not be enabled — double-check the credentials and scopes. ## Configure Ticket Behavior After enabling the integration, click **Configure** to set ticket creation preferences: | Setting | Description | | - | - | | **Client** | Halo client to associate with tickets (optional) | | **Team** | Halo team to assign tickets to | | **Category** | Incident category to assign to all tickets (required). | | **Create Tickets for Standalone Detections** | When enabled, tickets are created for detections that are closed and not part of a case | | **Case Ticket Title Template** | Title template for case tickets. Supports variables like `` `sid` `` and `` `title` `` | | **Detection Ticket Title Template** | Title template for detection tickets. Supports variables like `` `sid` `` and `` `title` `` | Click **Save** when done. ## Add a Webhook To have Wirespeed automatically close cases when a ticket is resolved in Halo and sync notes back, set up a webhook: 1. Log in to Wirespeed and navigate to [**Integrations**](https://app.wirespeed.co/settings/integrations) > select your Halo ITSM integration > **Configure** 2. Copy the **Webhook URL** and the **Webhook Secret** 3. Log in to your **Halo ITSM** instance 4. Navigate to **Configuration** > **Integrations** > **Webhooks** 5. Click **New** to create a webhook 6. Paste the **Webhook URL** from Step 2 7. Set **Authentication** to **Sign Request Body with a Secret Key** 8. Set the **Secret** to the **Webhook Secret** from Step 2 9. Configure the signature header name as `x-signature` and set the **Signing Algorithm** to `SHA-256` Halo's Signing Algorithm dropdown also offers `RSA-SHA256` and other RSA variants. Do **not** select one of these — Wirespeed cannot verify RSA-signed requests, and every webhook call will fail with a `400` error until the algorithm is changed back to `SHA-256`. 10. Add the following **Request Headers** to the signature, in this exact order: 1. `content-length` 2. `content-type` 3. `host` 4. `x-halo-date` All four headers are required. Omitting any of them invalidates the HMAC and Wirespeed returns `400`. Halo's **Version** field is ignored by Wirespeed. Leave the default; it does not affect signature verification. 11. Under **Events**, add **Ticket Updated by Agent**. In **Edit criteria**, set: * **Rule Type:** Contains (comma separated value) * **Summary:** `Wirespeed:, WSPD-, DTN-` 12. Add **Ticket Updated by User** with the same **Edit criteria** values 13. Save the webhook The webhook secret is required. Wirespeed verifies the `x-signature` header using HMAC-SHA256, keyed with the **Webhook Secret** from Step 2. Halo includes `x-halo-date` in that signature; Wirespeed also rejects callbacks whose `x-halo-date` is missing, unparseable, or more than **5 minutes** off the server clock. Halo should compute the signature from this canonical string: ```text theme={null} content-length: content-type: host: x-halo-date: ``` The resulting HMAC-SHA256 digest should be base64-encoded and sent in the `x-signature` header. ## How It Works * When a Wirespeed case or detection triggers, a ticket is created in Halo as an **Incident** with priority mapped from severity (Critical → P1, High → P2, Medium → P3, Low/Info → P4). * When a ticket is closed in Halo (status ID 9), the corresponding Wirespeed case is automatically closed. * Notes added to a ticket in Halo are synced back to the Wirespeed case timeline. * Comments added to a Wirespeed case or one of its detections are posted to the linked Halo ticket. # Have I Been Pwned Source: https://docs.wirespeed.co/integrations/have-i-been-pwned Discover breached credentials for your team members Wirespeed provides complementary Have I Been Pwned integrations for all of our clients. This integration is optional and will send the email addresses of your users to the HIBP API to check for breaches. Breach data will be present on each directory user's information page. Our integration only focuses on breaches that expose your user's passwords. Breach data is not included in global MTTD or MTTR calculations due to a significant delay between when a breach occurs and when it is made known to the public. # Horizon3 NodeZero Source: https://docs.wirespeed.co/integrations/horizon3 Integrate with Horizon3 NodeZero to verify whether detections can be correlated to pentest activity 1. Log in to your **Horizon3** portal. 2. Click the **User** > **Account Settings** menu 3. Generate an API key, using a Read-only role. 4. Copy the API key. 5. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Horizon3 NodeZero**. 6. Paste the key into the **Key** field. 7. Click **Integrate**. # Hyas Protect Source: https://docs.wirespeed.co/integrations/hyas-protect Ingest DNS logs from Hyas Protect ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Hyas Protect** and open **Forwarder Details** 2. Login to your Hyas Protect portal 3. Select the settings icon in the top right > **Organization Settings** 4. Select **Data Integrations** > **Syslog Data Export** 5. Provide the IP and listener port from **Forwarder Details** 6. Select **TCP** as the protocol 7. Verify access and save # Integration Health Source: https://docs.wirespeed.co/integrations/integration-health Understanding integration health statuses and how Wirespeed monitors your connected integrations Integration health is visible on the [Integrations](https://app.wirespeed.co/settings/integrations) settings page, each integration's detail page, and the home dashboard. Wirespeed continuously monitors every connected integration and surfaces its health status across the platform. If a detection source stops ingesting data, a remediation action starts failing, or a log feed goes quiet, you will see it immediately before it affects a case or an automated response. Health statuses are evaluated automatically on an ongoing basis. No configuration is required. ## Health Statuses | Status | Badge Color | Meaning | | - | - | - | | **Healthy** | Green | The integration is operating normally with no recent errors or warnings. | | **Unstable** | Yellow | The integration is experiencing intermittent errors or an elevated volume of warnings. | | **Unhealthy** | Red | The integration has persistent failures that may prevent it from delivering data or executing actions reliably. | | **Pending** | Gray | Health data is still being collected, the integration is in a maintenance window, or the integration type is not subject to health monitoring. | ## Where Health Is Displayed ### Dashboard The home dashboard includes a health distribution bar at the top of the Integrations card. The bar shows a color-coded breakdown of all connected integrations by health status. Clicking any segment navigates directly to the integrations list filtered to that status. Integrations in the dashboard list are sorted with Unhealthy integrations first, followed by Unstable, then Healthy, then Pending. Empty status groups are hidden. ### Integrations List Every row in the integrations list on the [Integrations](https://app.wirespeed.co/settings/integrations) settings page displays a health badge. The list is sorted by health status by default, so integrations that need attention appear at the top. Hovering over an Unhealthy or Unstable badge shows a tooltip with the number of errors or warnings detected and when the current status began. You can also filter the integrations list by health status using the filter bar above the table. ### Integration Detail Page Opening an individual integration displays its health badge in the page header. If the integration is Unhealthy or Unstable, a banner appears below the header with context-specific messaging: * **Unhealthy (critical-tier integration):** For detection sources, log sources, endpoint agents, and identity providers, the banner notes that the integration may be unable to send or receive data reliably, including automated remediation actions, and prompts you to check configuration or contact support. * **Unhealthy (other integration types):** The banner notes how long the integration has been failing. * **Unstable:** The banner notes that the integration is experiencing intermittent failures and shows when the status last changed. If the vendor publishes a status page, a link to it is included in the banner. ### 30-Day Activity Panel The integrations settings page includes a health panel above the integration list with two views: * **Donut chart** — shows the current count of integrations in each health status. * **Activity bar** — a single proportional bar showing the aggregate volume of Successes (green), Warnings (yellow), and Errors (red) logged across all integrations over the last 30 days. Hovering over a segment shows the total count for that type and the top contributing integrations by volume. Clicking the Errors or Warnings segment navigates to the integrations list filtered to the corresponding health status. ## How Health Is Determined Wirespeed evaluates health based on recent activity logs from each integration. The evaluation runs automatically every hour. The system applies different thresholds depending on what an integration does: * **Detection and log sources** (e.g. CrowdStrike, SentinelOne, Microsoft Defender) are monitored most aggressively. Errors that persist for 4 hours, or a high error rate within a single hour, will trigger an Unhealthy status. * **Endpoint agents and identity providers** (e.g. Jamf Pro, Okta, Entra ID) are flagged as Unhealthy if errors occur on three consecutive calendar days. * **Remediation actions, notification delivery, webhooks, and ticketing** (e.g. endpoint isolation, user disable, Slack message delivery, Jira) are flagged as Unstable after errors persist for 4 hours **and** at least one later failure confirms the problem is still happening (a single error followed by idle time does not escalate). Once Unstable, these failure streaks stay open until the action succeeds again (or there has been about a week with no further errors) — idle silence shorter than that does not return them to Healthy. * **Enrichment integrations** (e.g. threat intelligence, IP lookup, file reputation) are given a longer window — errors must persist for 24 hours before the integration is marked Unhealthy. An integration will not immediately return to Healthy after an issue is resolved. * For detection, log, identity, endpoint, and enrichment monitoring, Wirespeed requires a 24-hour quiet period with no errors or warnings in the affected areas before the status clears. This prevents flapping caused by transient recoveries. * For remediation, notification, webhook, and ticketing actions, an open Unstable failure streak clears when a successful run is logged, or when there have been no further errors for about a week (not when the integration is merely idle for a shorter period). After that success or idle clear, the usual quiet period still applies so a single recovery does not flap the badge. Integrations in a configured maintenance window show as **Pending** during that period and are excluded from health evaluation. ## Email Notifications Email notifications for health transitions are currently rolling out gradually and may not yet be enabled for all accounts. The in-app badges, banners, dashboard bar, and activity panel are available to all customers now. When email notifications are enabled for your account, Wirespeed will send an alert when an integration transitions to a new health state: * **Unhealthy** — sent when an integration crosses the failure threshold for its type. * **Recovered** — sent when an integration returns to Healthy after a period of Unhealthy status. Unstable transitions are shown in the product (badges, banners, daily activity summary) but are not emailed, to avoid noise from intermittent warnings. Notifications respect integration-level muting. If an integration has been muted by an operator, health transition emails will not be sent for that integration. ## FAQ Pending means health data is still being collected for that integration, the integration is in an active maintenance window, or the integration type is not subject to health monitoring. For newly connected integrations, the status will update within the first evaluation cycle. It depends on the integration type. Detection and log sources are marked Unhealthy after 4 hours of persistent errors or a high error rate within a single hour. Endpoint agents and identity providers are marked Unhealthy after errors on three consecutive calendar days. Remediation, notification, and ticketing integrations are marked Unstable after 4 hours when failures recur (a later error after the first, with no successful run in between). Enrichment integrations require 24 hours of persistent errors before becoming Unhealthy. For detection and similar continuously monitored sources, Wirespeed requires a 24-hour quiet period with no errors or warnings before the status returns to Healthy. That prevents flapping during partial recoveries. For ticketing and other event-driven actions, Unstable is cleared by a successful run of that action (or when there have been no further errors for about a week), not by a short idle gap alone. After a success, the quiet period still applies before the badge flips to Healthy. If the integration has truly recovered and the status has not updated, try triggering a manual health check from the [Integrations](https://app.wirespeed.co/settings/integrations) settings page. Yes. When email notifications are enabled for your account, Wirespeed sends a recovery notification when an integration returns to Healthy after being Unhealthy. Slack, Teams, and Email integrations are monitored at the same level as remediation integrations. They will typically show as Healthy when message delivery is functioning normally, and may show Unstable or Unhealthy if message delivery fails persistently. # Introduction to Integrations Source: https://docs.wirespeed.co/integrations/introduction Connect your security stack to enable automated detection and response Wirespeed connects to your existing security tools to provide automated threat detection, investigation, and response. Our integrations are designed to work together—combining detection sources with user directories, endpoint managers, and communication platforms to enable a fully automated MDR experience. New to Wirespeed? Start by connecting a [user directory](#user-directories) and a [detection source](#detection-sources) to see our automation in action. ## How Integrations Work When you connect an integration, Wirespeed automatically: 1. **Syncs your data** — We pull user directories, endpoint inventories, and detection history to build context about your environment 2. **Ingests detections** — Security alerts flow into Wirespeed in real-time from your detection platforms 3. **Enriches and triages** — Each detection is automatically enriched with context and triaged using our verdict system 4. **Takes action** — Based on your configured verdicts, Wirespeed can remediate threats, notify users via chat ops, or escalate to your team All integrations use secure OAuth or API tokens. We request only the permissions necessary to deliver our service and never store credentials in plain text. ## Webhook Rate Limiting Integrations that deliver data via webhooks are subject to a rate limit of **3,000 requests per minute per team**. If a team exceeds this limit, Wirespeed will respond with HTTP `429 Too Many Requests` until the rate drops below the threshold. This protects the platform from misconfigured or overly aggressive webhook sources. If you encounter rate limiting, check whether the source system is sending duplicate or unnecessary events and reduce the webhook frequency accordingly. ## Source System Updates When Wirespeed processes a detection, it can sync verdict, status, notes, and comments back to the originating integration. This is called a **source system update**. It keeps your detection platform in sync with Wirespeed's triage decisions. Source system updates are controlled at three levels: ### Integration-Level Control Each integration has a **Source Updates** toggle available from the row actions menu on the [**Integrations**](https://app.wirespeed.co/settings/integrations) page. When disabled, Wirespeed will not sync verdict, status, notes, or comments back to that integration for any detection. ### Team-Level Control Under [**Settings > Team Settings**](https://app.wirespeed.co/settings/team), the **Skip Managed Source Updates** toggle controls whether Wirespeed skips source system updates for detections that are managed by a third party (e.g. CrowdStrike Falcon Complete, SentinelOne Vigilance). This is useful when a third-party managed service is already triaging detections in your security platform. Enabling it prevents Wirespeed from overwriting their work by writing verdicts or comments back to those specific detections, while still syncing updates for detections that are not third-party managed. ### Group-Level Control Groups also have an **Update Source System** toggle. When disabled for a group, detections involving assets in that group will not trigger source system updates. See [Groups](/groups/introduction) for details. If an asset belongs to **any** group that has source system updates disabled, the update is suppressed for detections involving that asset—even if other groups have it enabled. ## Beta Integrations Some integrations are marked as **beta** while we refine their capabilities. Beta integrations work for detection ingestion, asset syncing, and manual actions, but have one important limitation: Auto-remediation is not performed for detections from beta integrations. If a detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation remains available. Beta integrations are labeled in the platform. Once an integration graduates from beta, auto-remediation will apply normally. ## Integration Categories EDR, XDR, and SIEM platforms that generate security alerts Identity providers that define your users and their attributes MDM and endpoint platforms that inventory your devices Chat and messaging platforms for user verification Ticket systems for case management and escalation Threat intelligence and data enrichment services AI platforms and LLM provider security telemetry *** ## Detection Sources Detection sources are the foundation of Wirespeed. These integrations provide the security alerts that Wirespeed automatically triages and responds to. Connect your EDR, XDR, identity protection, or SIEM platform to get started. Cyber Protect Cloud Alert Manager detections including email threats Endpoint privilege management and privilege-elevation security events Anti-ransomware detection and response CloudTrail and GuardDuty security events Unified endpoint and email security Endpoint detection, NG-SIEM, and identity security AI-powered network detection and response Email threat scans (formerly Perception Point) Google Workspace security alerts Google Security Operations SIEM detections Google Cloud security findings Anti-ransomware detection and response Autonomous pentesting and attack simulation validation DNS and web security events Mac-focused endpoint security Defender for Endpoint, Entra ID Protection, Sentinel, and more Email security and threat protection SSE alerts, web/SaaS/ZTNA/network events, and users RMM/MDM alerts, activity telemetry, and device inventory Identity threat detection Cortex XDR/XSIAM alert ingestion and endpoint management Breach and attack simulation validation Email threat detection and protection Cloud security posture and workload protection Breach and attack simulation Agentless Linux detection and host telemetry Autonomous endpoint protection platform Intercept X endpoint detections and event telemetry SIEM detection ingestion Email threat detection and protection Deconflict detections from vulnerability scanning Cloud-native deception platform alerts Honeypot-based intrusion detection Network detection and response Cloud security findings and vulnerability ingestion WordPress security and firewall *** ## User Directories User directories help Wirespeed understand your organization. We sync users, groups, roles, and managers to enrich detections with context and enable features like VIP protection, chat ops escalation, and user remediation. Multi-factor authentication directory Privilege Cloud audit events and Identity directory sync Google directory and sign-in logs Directory events with user and endpoint sync Entra ID (Azure AD) directory sync User directory sync from the Netskope tenant Directory sync with user suspend and re-enable actions Universal directory and SSO PingOne audit activity monitoring Connecting a user directory unlocks automatic VIP detection, manager escalation paths, and user-aware threat context. *** ## Endpoint Management Endpoint management integrations provide device inventory and health data. Wirespeed uses this information to identify critical assets, correlate detections with device context, and enable endpoint remediation actions. Device and asset inventory synchronization Host management, isolation, and identity osquery-based device inventory and activity telemetry Endpoint inventory and agent status Apple device management Modern Apple MDM (formerly Kandji) AD audit and endpoint monitoring Cloud-based endpoint management Linux host inventory and enrichment Endpoint inventory and remediation *** ## Communication Communication integrations enable [Chat Ops](/chat-ops/introduction)—Wirespeed's ability to verify suspicious activity directly with your users. When a detection requires user verification, we reach out through your existing communication channels. Email-based user notification Send emails from your own domain In-app chat ops experience Direct message users for verification SMS verification is available as an add-on to any communication integration for enhanced identity verification. [Learn more about SMS Chat Ops](/chat-ops/communication-plan#sms-chat-ops). *** ## Ticketing Ticketing integrations sync Wirespeed cases with your existing ticket management system. Cases and detections can automatically create tickets, and updates flow bidirectionally. Professional services automation Digital forensics and incident response case management IT service management ticketing and case sync IT service management ticketing and case sync Atlassian's cloud-hosted Jira Self-hosted Jira deployment Odoo Helpdesk ticket management Incident management and on-call alerting *** ## Enrichment Enrichment integrations provide additional context and threat intelligence to enhance detection triage. These services help identify known-bad indicators and provide reputation data. Credential breach detection IP address geolocation and ASN data File reputation and malware analysis *** ## AI Security AI Security integrations connect LLM providers and AI platforms so Wirespeed can ingest usage, audit, and security telemetry from those systems. AI platform usage and security events Administrative, configuration, and authentication audit events *** ## Log Forwarding For platforms without native integrations, Wirespeed supports standard log forwarding protocols and network-based telemetry sources. These allow you to send security events from any source, including firewalls, network devices, and log aggregation platforms. See [Log Forwarders](/integrations/log-forwarders) for how Wirespeed provides connection details and how to configure your sources. Password manager audit and sign-in events Firewall activity, threat, and VPN authentication logs Organization events and user activity Cloud content management events Next-gen firewall and network security events Firewall connection, access-list, VPN, and admin logs Syslog forwarding from Cisco Catalyst network devices Cloud-managed network security DNS-layer security DNS-layer security Network and security syslog events Centralized log and analytics Next-gen firewall security events Webhook-based JSON ingestion CEF and standard syslog formats Security and audit events from GitHub Organization audit events from GitHub Enterprise Cloud Adversary infrastructure intelligence On-premises Active Directory Standalone Entra ID sign-in data SSE application, page, network, and ZTNA connection events PAN-OS firewall and security syslog events Change request validation for planned maintenance workflows Next-gen firewall security events Webhook delivery for Stairwell detection events Gateway, switch, and access point syslog events VPN authentication, traffic, and alarm syslog events Windows event forwarding Infrastructure monitoring alerts ZPA App Connector syslog forwarding *** ## Getting Started Ready to connect your first integration? Here's the recommended order: Start with [Microsoft 365](/integrations/microsoft), [Google Workspace](/integrations/google-workspace), or [Okta](/integrations/okta) to import your users and organizational structure. Connect your primary security platform—[Microsoft Defender](/integrations/microsoft), [CrowdStrike](/integrations/crowdstrike-falcon), or [SentinelOne](/integrations/sentinel-one) are great starting points. Set up [Slack](/integrations/slack) or [Microsoft Teams](/integrations/microsoft-teams) to enable Chat Ops for user verification. Review your [remediation settings](/remediation/introduction) to enable automated threat response. Need help setting up an integration? Use the **Chat** button in the Wirespeed platform to talk directly with our engineers, or email [support@wirespeed.co](mailto:support@wirespeed.co). # IPinfo Source: https://docs.wirespeed.co/integrations/ipinfo Enrich IP information Wirespeed provides a complementary [IPinfo](https://ipinfo.io/) integration for all of our clients. This integration sends the IP addresses from your detections to the IPInfo API to get metadata. IP data will be present on each IP's information page. # Iru Source: https://docs.wirespeed.co/integrations/iru Sync your devices and threats from Iru (formerly Kandji) 1. Login to your Iru portal > **Settings** > **Access** > **Create API Token** 2. **Save** the API token and continue to configure the following permissions: 1. **Users** 1. List users 2. Get user 2. **Threat Details** 1. Get Behavioral Detections 2. Get File Detections 3. **Devices** 1. Device Information 1. Device details 2. Device list 3. Device ID 4. Device Status 5. Device Activity 2. Device Actions 1. Lock device 3. Navigate to **Settings** > **Access** and save your organization API URL. It should look like `[subdomain].api.iru.com` or `[subdomain].api.kandji.io`. Your URL may include a region-specific subdomain as well (e.g. `.eu`). 4. Login to Wirespeed and navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Iru (formerly Kandji) 5. Provide your API URL and API token and click Integrate On first sync, Wirespeed fetches detections from the last **7 days**. # Jamf Internet Security Source: https://docs.wirespeed.co/integrations/jamf-internet-security Integrate with Jamf Internet Security for DNS and web security event ingestion Jamf Internet Security integration documentation is coming soon. You can express interest from [Integrations → View all](https://app.wirespeed.co/settings/integrations?tab=browse\&status=coming-soon). # Jamf Pro Source: https://docs.wirespeed.co/integrations/jamf-pro Integrate with Jamf Pro to identify devices in your organization 1. Login to your **Jamf Pro** instance 2. Navigate to **Settings** > **API Roles and Clients** 3. Create an **API Role** with the following permissions 1. Read Computers 2. Read Mobile Devices 3. Send Computer Remote Lock Command 4. Create an **API Client** 1. Assign the role from Step 3 2. Set access token lifetime to 3,600 seconds 3. Select "Enable API client" 4. Click **Save** 5. In the confirmation dialog, click **Copy client credentials to clipboard** 6. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Jamf Pro** 7. Enter your Jamf Pro subdomain (e.g., `acme` for acme.jamfcloud.com) 8. Click the **Paste** button and paste the credentials JSON from Step 5 9. Click **Integrate** # Jamf Protect Source: https://docs.wirespeed.co/integrations/jamf-protect Integrate with Jamf Protect to identify devices and detections in your organization 1. Login to your **Jamf Protect** instance 2. Navigate to **Settings** > **Account** > **Roles** 3. Create a new role, assigning it: * Read & Write permissions for Alerts * Read permissions for Compliance, Computers, Downloads, and Plans 4. Navigate to **Settings** > **API Clients** 5. Click **Create API Client** and assign it the role you just created 6. Save the **Client ID** and **Client Secret** and the **URL** of your Jamf Protect instance 7. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Jamf Protect** 8. Provide the information from Step 6 On first sync, Wirespeed fetches alerts from the last **30 days**. # Jira Cloud Source: https://docs.wirespeed.co/integrations/jira-cloud Integrate with Jira Cloud to sync Wirespeed cases with your team ## Integrate Wirespeed with Jira Cloud 1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **Jira Cloud** and click **Integrate** 3. A new tab will open in which Wirespeed is requesting permission to read and write Jira issues 4. Click **Accept** to grant Wirespeed access to your Jira instance 5. Navigate back to Wirespeed and refresh the [integrations](https://app.wirespeed.co/settings/integrations) page 6. Click on the newly added "Jira Cloud" integration 7. A configuration modal will open, prompting you to select: 1. the Jira **cloud** 2. the Jira **project** 3. the Jira **issue type** 8. Click **Save** ## Add a Webhook If you would like to ensure that cases are closed in Wirespeed when their associated Jira issue is closed, you need to set up webhooks in your Jira Cloud administrative settings. 1. Login to Wirespeed and navigate to [**Integrations**](https://app.wirespeed.co/settings/integrations) > Select your created Jira Cloud integration > **Configure** 2. Copy the webhook URL 3. Login to your **Jira Cloud** 4. Open the Command Palette (`cmd+K` on Mac, `ctrl+K` on Windows) and type `webhook` 5. Select the System Settings > **Go to Webhooks** option 6. Click **Create a webhook** 7. Provide the webhook URL from Step 3 8. Under **Issue related events**, enter the JQL expression `summary~"WSPD-*"` to filter only Wirespeed cases 9. Select **Issue updated** and **Comment created** for the event 10. Click **Create** ### Optional webhook authentication To authenticate callbacks, copy the **Webhook Secret** from Wirespeed's Webhook Details and configure it as the Jira webhook secret. Jira will send an `X-Hub-Signature` for each callback. After Jira is configured with the secret, enable **Verify Webhook Authenticity** in the Jira Cloud integration configuration. Leave this option disabled until Jira is sending signed callbacks; unsigned callbacks are rejected while it is enabled. # Jira Data Center Source: https://docs.wirespeed.co/integrations/jira-data-center Integrate with Jira Data Center to sync Wirespeed cases with your team ## Create an Application Link You may also use [Jira's documentation](https://confluence.atlassian.com/adminjiraserver/configure-an-incoming-link-1115659067.html) for creating the application link. 1. Login to your **Jira Data Center** instance 2. Go to Administration > Application > **Application Links** 3. Select **Create Link** 4. Select **External Application**, and then choose **Incoming** as the direction 5. Provide Write and Read permissions 6. Provide `https://api.wirespeed.co/integration/oauth/redirect` as the callback URL 7. Save the Client ID and Client Secret 8. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Jira Data Center** 9. Provide your Client ID and Client Secret 10. Provide the URL of your Jira Data Center instance 11. Select **Add Integration** 12. Complete the configuration steps After adding the integration, if you need to authenticate via an intermediate firewall, expand the Advanced Options, provide the required header (cannot be `Authorization`), click save, then complete the other required fields. ## Add a Webhook If you would like to ensure that cases are closed in Wirespeed when their associated Jira issue is closed, you need to set up webhooks in Jira Data Center. You may also use [Jira's documentation](https://developer.atlassian.com/server/jira/platform/webhooks/) for steps 4-10. 1. Login to Wirespeed and navigate to [**Integrations**](https://app.wirespeed.co/settings/integrations) > Select your created Jira Data Center integration > **Configure** 2. Save the webhook URL 3. Login to your Jira Data Center instance 4. Go to Jira administration console > System > Webhooks (in the Advanced section) 5. Click **Create a webhook** 6. Provide the webhook URL from Step 2 7. Provide the JQL expression `summary~"WSPD-*"` to filter only Wirespeed cases 8. Select **Issue updated** for the event 9. **Create** ### Optional webhook authentication If your Jira Data Center version supports webhook secrets, copy the **Webhook Secret** from Wirespeed's Webhook Details and configure it on the Jira webhook. Jira will send an `X-Hub-Signature` for each callback. After Jira is configured with the secret, enable **Verify Webhook Authenticity** in the Jira Data Center integration configuration. Leave this option disabled if your Jira version cannot sign webhooks; unsigned callbacks are rejected while it is enabled. # JumpCloud Source: https://docs.wirespeed.co/integrations/jumpcloud Ingest directory events and sync users and endpoints from JumpCloud ## Overview Wirespeed connects to JumpCloud using the [Service Account for APIs](https://jumpcloud.com/support/service-account-for-apis) feature, which issues OAuth 2.0 client credentials (`client_id` / `client_secret`). Wirespeed collects: * **Directory events** — authentication, account changes, and group management events via the [Directory Insights API](https://docs.jumpcloud.com/api/insights/directory/1.0/index.html) * **Users** — all system users for identity tracking and remediation * **Endpoints** — all JumpCloud-managed systems for endpoint asset tracking * **Groups** — JumpCloud user and system groups, kept in sync with Wirespeed group memberships ## Prerequisites ### Apple MDM For Apple MDM support, see JumpCloud's [Get Started: Apple MDM](https://jumpcloud.com/support/get-started-mdm) guide. This is required if you want to manage Apple devices via Jumpcloud from within Wirespeed. ### Enable Directory Insights Directory Insights must be enabled for your JumpCloud organization before events can be ingested. 1. Log in to [console.jumpcloud.com](https://console.jumpcloud.com) as an Administrator 2. Navigate to **Directory Insights** in the left sidebar 3. If prompted, enable the service for your organization ### Create a Service Account 1. Log in to [console.jumpcloud.com](https://console.jumpcloud.com) as an Administrator 2. Click your account name in the top-right corner and select **My API Keys & Service Accounts** 3. Under **Service Accounts**, click **Add Service Account** 4. Give the service account a descriptive name (e.g. `Wirespeed`) 5. Under **Roles**, assign a role — see [Permissions](#permissions) below 6. Click **Save** 7. Copy the **Client ID** and **Client Secret** — the secret is only shown once ## Permissions ### Option 1 — Manager Role (Simplest) Assign the built-in **Manager** admin role to the service account. This grants all permissions required by the integration without additional configuration. ### Option 2 — Custom Role (Least Privilege) For organizations that require least-privilege access, create a custom admin role with only the permissions Wirespeed needs. See [Custom Admin Roles](https://jumpcloud.com/support/custom-admin-roles) for instructions on creating a custom role. Enable the following permissions in the custom role: **Device Management** | Permission | Level | | - | - | | Devices | Full Access | **User Management** | Permission | Level | | - | - | | User Management | View + Update | | Unlock User Accounts | ✓ | | Expire User Password | ✓ | | Activate / Suspend Users | ✓ | | Manage User MFA | ✓ | **Groups** | Permission | Level | | - | - | | Groups | Read | **Monitoring & Analytics** | Permission | Level | | - | - | | Directory Insights | View | # Log Forwarders Source: https://docs.wirespeed.co/integrations/log-forwarders Send logs to Wirespeed using a dedicated forwarder Many Wirespeed integrations accept logs from firewalls, network devices, and other sources through a **forwarder**. After you add the integration, Wirespeed prepares that forwarder and shows the connection details you need. ## Set up a forwarder 1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select the integration for your vendor or log source and click **Integrate** 3. Set a **Source Name** so you can tell multiple instances of the same vendor apart in Integrations 4. Wirespeed prepares the forwarder after the integration is added 5. **Forwarder Details** opens automatically when setup finishes while you remain on the integration page 6. Copy the IP address or domain and the listener port(s) shown there 7. Configure your vendor or source to send logs using those details 8. Confirm logs appear in **Events** Each integration page covers any vendor-specific steps, protocol choices, or formats. ## Understanding the connection details **Forwarder Details** shows an IP address or domain and one or more listener ports. Each listener also shows whether its connection is TLS encrypted (**TLS: Enabled**) or not (**TLS: Disabled**). Your devices send logs to that destination. The port identifies which Wirespeed integration the logs belong to, so they appear under the correct vendor in **Events**. ## Syslog over TLS Enable **Enable TLS on TCP socket** only when the vendor will send TCP syslog over TLS. Wirespeed presents a Let's Encrypt certificate. Browsers already trust that chain. Many firewalls and appliances (including Cisco ASA) do not, and may need a CA imported as a trustpoint before secure syslog will connect. ### Root CA Import the Let's Encrypt root as the trustpoint: [ISRG Root X1](https://letsencrypt.org/certs/isrgrootx1.pem) Use the root when you can. Intermediate CAs change more often; if you install one of those instead, you may have to update the appliance again later. ### Intermediate chain Use this only if the device will not accept a root trustpoint and requires the issuing CA. Replace the placeholders with the domain and TLS port from Forwarder Details: ```bash theme={null} echo Q | openssl s_client -connect : \ -servername -showcerts \ | awk ' /-----BEGIN CERTIFICATE-----/ { n++; keep = (n > 1) } keep { print } /-----END CERTIFICATE-----/ { keep = 0 } ' > chain.pem ``` `chain.pem` contains the intermediate CA. Import that file on the device. ### Certificate revocation (CRL) checks If your firewall or appliance performs certificate revocation checks (CRL) on the Wirespeed forwarder certificate, you must allow outbound access to the domain `*.c.lencr.org` (for example `r13.c.lencr.org`) over **HTTP (TCP port 80)**. If the device cannot reach `*.c.lencr.org` over HTTP, the CRL check fails and the TLS connection to the forwarder may be rejected, so no logs arrive. Add `*.c.lencr.org` (HTTP) to your firewall allow list, or disable CRL checking for the trustpoint. ## When do I need multiple forwarders? **Different vendors or services** need separate integrations — and therefore separate forwarders. For example, a SonicWall firewall and a Cisco Meraki deployment each get their own connection details. **Multiple devices of the same vendor** can usually share one forwarder. Several FortiGate firewalls, for example, can all send to the same IP and port. Use device name, source IP, or other fields in the logs to tell appliances apart. If you want separate groups of the same vendor (for example, firewalls in different regions), add another integration of that type and give each a distinct **Source Name**. Each integration gets its own forwarder and appears separately in **Events**. # ManageEngine ADAudit Plus Source: https://docs.wirespeed.co/integrations/manage-engine Ingest syslog events from ManageEngine If you want to add multiple ADAudit Plus instances, you only need one Wirespeed integration. Reuse the same **Forwarder Details** for all of your instances. ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **ManageEngine ADAudit Plus** and open **Forwarder Details** 2. Login to ManageEngine 3. Navigate to the **Admin** tab 4. Under System Settings select **Integrations** 5. Under Log Forwarding select **Syslog** 1. **Syslog Server**: IP from **Forwarder Details** 2. **Port**: Listener port from **Forwarder Details** 3. **Protocol**: UDP 4. **Syslog Standard**: RFC 5424 5. **Data Format**: Leave default ManageEngine logs should reflect shortly underneath the Events page. # Microsoft 365 Source: https://docs.wirespeed.co/integrations/microsoft Defender for Endpoint, Identity, Cloud, Cloud Apps, Sentinel, and more. ## Getting Started ### How our integration works We use Microsoft's [OAuth](https://learn.microsoft.com/en-us/entra/architecture/auth-oauth2) support for you to authorize Wirespeed to access your Microsoft tenant, collect a daily inventory of your licensed Microsoft products, and begin syncing your directory data (users and endpoints) and security telemetry. If you license a new Microsoft product today or 3 years from now, we'll notice, pull the telemetry, and begin triaging detections on your behalf. For details about the required permissions to do this work, read the Permission Details section below. ### Integrating To get started, [add a new integration](https://app.wirespeed.co/settings/integrations?tab=browse) and select Microsoft. You will be redirected to the OAuth Consent Page. Connect the Microsoft integration using a Global Administrator account. Wirespeed validates access to your tenant's subscribed SKUs during setup, and Microsoft commonly withholds that access unless the consent flow is completed by a Global Administrator. ### Testing #### Microsoft Defender for Endpoint Running any of the below commands will trigger a detection for Microsoft Defender for Endpoint and will be ingested by Wirespeed. They will automatically be identified as test events by Wirespeed. * [EICAR test string](https://learn.microsoft.com/en-us/defender-endpoint/validate-antimalware) * [Malicious command](https://learn.microsoft.com/en-us/defender-endpoint/run-detection-test) #### Microsoft Entra ID Protect * [Anonymous IP Address](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-simulate-risk#anonymous-ip-address) * [Unfamiliar Sign-in Properties](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-simulate-risk#unfamiliar-sign-in-properties) * [Atypical Travel](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-simulate-risk#atypical-travel) * [Leaked Credentials](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-simulate-risk#leaked-credentials-for-workload-identities) Depending on your licensing level, [additional tests](https://learn.microsoft.com/en-us/defender-endpoint/defender-endpoint-demonstrations#demonstrations) are available as well. ## Errors ### AADSTS650051 AADSTS650051: Consent action for Application 'UUID' failed due to the following error: ... service principal name is already present for the tenant ... This is a common error from Microsoft due to an error in their OAuth consent process. If you are a Wirespeed user, log in to Wirespeed and try [adding the integration](https://app.wirespeed.co/settings/integrations?tab=browse) from the start again. If a URL was shared with you to integrate Wirespeed, follow that URL and try consenting once more. If the issue persists, please contact [support@wirespeed.co](mailto:support@wirespeed.co). ### AADSTS650052 This error means your tenant is missing a service principal for a Microsoft service that Wirespeed requests during OAuth consent. Match the application ID in your error message to a service below, then expand that section for fix steps. You may see this error more than once during integration setup, each time for a **different** Microsoft application. That is expected. Follow the fix steps for whichever application is named in the current error, then retry integration from Wirespeed until consent completes. | Service | Application ID | | - | - | | WindowsDefenderATP | `fc780465-2017-40d4-a0c5-307022471b92` | | Microsoft Cloud App Security | `05a65629-4c1b-48c1-a78b-804c4abdd4af` | If the service in your error is not listed above, copy the **application ID** (UUID) from the error details on the Wirespeed integration error page. It appears immediately after `access a service` — for example, in `access a service '05a65629-4c1b-48c1-a78b-804c4abdd4af'(Microsoft Cloud App Security)`, the application ID is `05a65629-4c1b-48c1-a78b-804c4abdd4af`. Use that UUID in the **Other service** section below. AADSTS650052: The app is trying to access a service 'fc780465-2017-40d4-a0c5-307022471b92'(WindowsDefenderATP) that your organization '\[ORGANIZATION\_ID]' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal. This error means you have not purchased Microsoft Defender for Endpoint. If you would like to proceed without purchasing, add a placeholder service principal so Microsoft allows the integration to continue. The placeholder is associated with application id `fc780465-2017-40d4-a0c5-307022471b92`, a built-in Microsoft application for Defender for Endpoint. Choose **either** Graph Explorer **or** PowerShell — you only need to complete one method, not both. 1. As a global administrator, navigate to [Microsoft Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=servicePrincipals\&method=POST\&version=v1.0\&GraphUrl=https://graph.microsoft.com\&requestBody=eyJhcHBJZCI6ICJmYzc4MDQ2NS0yMDE3LTQwZDQtYTBjNS0zMDcwMjI0NzFiOTIifQ==) 2. In the top right, make sure the Tenant shown is the one you want to integrate with. Otherwise select your profile icon next to that field and change accounts. 1. If the Request Body dialogue box is empty, paste in `{"appId": "fc780465-2017-40d4-a0c5-307022471b92"}` 3. Select Modify Permissions and consent to both required permissions 1. If the permissions do not show up, manually select `Application.ReadWrite.All` and `Directory.ReadWrite.All` 4. Click run query Make sure you receive a `201 Created` response. Then retry the [integration setup](https://app.wirespeed.co/settings/integrations?tab=browse) from Wirespeed. 1. Open PowerShell as a global administrator. 2. Install the [Microsoft Graph PowerShell SDK](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation) if it is not already installed: ```powershell theme={null} Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force ``` 1. Sign in to your tenant and consent to `Application.ReadWrite.All`: ```powershell theme={null} Connect-MgGraph -Scopes "Application.ReadWrite.All" ``` 1. Create the placeholder service principal: ```powershell theme={null} New-MgServicePrincipal -AppId "fc780465-2017-40d4-a0c5-307022471b92" ``` The command returns the created service principal when successful. Then retry the [integration setup](https://app.wirespeed.co/settings/integrations?tab=browse) from Wirespeed. AADSTS650052: The app is trying to access a service '05a65629-4c1b-48c1-a78b-804c4abdd4af'(Microsoft Cloud App Security) that your organization '\[ORGANIZATION\_ID]' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal. This error means you have not purchased or provisioned [Microsoft Defender for Cloud Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps) (formerly Microsoft Cloud App Security) in your tenant. Wirespeed requests Cloud Apps access to ingest security alerts from that service. If you do not use that feature, add a placeholder service principal so Microsoft allows the integration to continue. The placeholder is associated with application id `05a65629-4c1b-48c1-a78b-804c4abdd4af`, a built-in Microsoft application for Microsoft Cloud App Security. Choose **either** Graph Explorer **or** PowerShell — you only need to complete one method, not both. 1. As a global administrator, navigate to [Microsoft Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=servicePrincipals\&method=POST\&version=v1.0\&GraphUrl=https://graph.microsoft.com\&requestBody=eyJhcHBJZCI6ICIwNWE2NTYyOS00YzFiLTQ4YzEtYTc4Yi04MDRjNGFiZGQ0YWYifQ==) 2. In the top right, make sure the Tenant shown is the one you want to integrate with. Otherwise select your profile icon next to that field and change accounts. 1. If the Request Body dialogue box is empty, paste in `{"appId": "05a65629-4c1b-48c1-a78b-804c4abdd4af"}` 3. Select Modify Permissions and consent to both required permissions 1. If the permissions do not show up, manually select `Application.ReadWrite.All` and `Directory.ReadWrite.All` 4. Click run query Make sure you receive a `201 Created` response. Then retry the [integration setup](https://app.wirespeed.co/settings/integrations?tab=browse) from Wirespeed. 1. Open PowerShell as a global administrator. 2. Install the [Microsoft Graph PowerShell SDK](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation) if it is not already installed: ```powershell theme={null} Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force ``` 1. Sign in to your tenant and consent to `Application.ReadWrite.All`: ```powershell theme={null} Connect-MgGraph -Scopes "Application.ReadWrite.All" ``` 1. Create the placeholder service principal: ```powershell theme={null} New-MgServicePrincipal -AppId "05a65629-4c1b-48c1-a78b-804c4abdd4af" ``` The command returns the created service principal when successful. Then retry the [integration setup](https://app.wirespeed.co/settings/integrations?tab=browse) from Wirespeed. Use this section when the application ID from your error is not in the table above. Expand **Show Error Details** on the Wirespeed integration error page and copy the UUID in single quotes after `access a service`. Example error detail: ``` access_denied: AADSTS650052: The app is trying to access a service '05a65629-4c1b-48c1-a78b-804c4abdd4af'(Microsoft Cloud App Security) that your organization '01e288fd-692b-40c7-ac92-58e47ec12340' lacks a service principal for. ... ``` In this example, use application ID `05a65629-4c1b-48c1-a78b-804c4abdd4af`. Replace `YOUR_APP_ID` in the steps below with the UUID from your error. This error means your tenant is missing a service principal for a Microsoft service that Wirespeed requests during OAuth consent. If you have not purchased or provisioned that service, you can add a placeholder service principal so Microsoft allows the integration to continue. Choose **either** Graph Explorer **or** PowerShell — you only need to complete one method, not both. 1. As a global administrator, navigate to [Microsoft Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=servicePrincipals\&method=POST\&version=v1.0\&GraphUrl=https://graph.microsoft.com) 2. In the top right, make sure the Tenant shown is the one you want to integrate with. Otherwise select your profile icon next to that field and change accounts. 3. Set the request body to (replace `YOUR_APP_ID` with the UUID from your error): ```json theme={null} {"appId": "YOUR_APP_ID"} ``` 1. Select Modify Permissions and consent to both required permissions 1. If the permissions do not show up, manually select `Application.ReadWrite.All` and `Directory.ReadWrite.All` 2. Click run query Make sure you receive a `201 Created` response. Then retry the [integration setup](https://app.wirespeed.co/settings/integrations?tab=browse) from Wirespeed. 1. Open PowerShell as a global administrator. 2. Install the [Microsoft Graph PowerShell SDK](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation) if it is not already installed: ```powershell theme={null} Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force ``` 1. Sign in to your tenant and consent to `Application.ReadWrite.All`: ```powershell theme={null} Connect-MgGraph -Scopes "Application.ReadWrite.All" ``` 1. Replace `YOUR_APP_ID` with the UUID from your error, then create the placeholder service principal: ```powershell theme={null} New-MgServicePrincipal -AppId "YOUR_APP_ID" ``` The command returns the created service principal when successful. Then retry the [integration setup](https://app.wirespeed.co/settings/integrations?tab=browse) from Wirespeed. ### AADSTS50097 AADSTS50097: Device authentication is required. This error occurs when your Microsoft Entra tenant has [Conditional Access policies](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview) that require device authentication. Your tenant administrator has configured policies that only allow sign-in from devices that are Azure AD joined, hybrid joined, or marked as compliant. To resolve this issue: 1. **Use an authorized device** — Perform the OAuth connection from a device that is joined to your Azure AD domain or marked as compliant in Intune/Endpoint Manager. 2. **Avoid incognito or private browsing** — Private browsing sessions cannot present device credentials, which will cause this error even on an otherwise authorized device. 3. **Contact your IT administrator** — If you are unsure which devices are authorized, ask your IT admin to verify that the device you are using meets your organization's Conditional Access requirements. ## Permission Details We need a variety of permissions to integrate with your Microsoft tenant. The permissions manifest during the oAuth challenge can appear daunting or even unnecessary; we understand, which is why we only request permissions we need to deliver the best experience for you. ### Read Access * The majority of the listed permissions in the oAuth dialog are read only. Microsoft requires us to request them individually, so the list seems long. At a high level, we need to read: * Security Alerts, obviously, because we need to triage these * IOCs (indicators of compromise), because these are a form of detection * Audit Log data, where important supplementary security telemetry lives * Sign in logs and data, so we can perform detections and analysis * Organization Information, which is metadata about your tenant itself, so we can ensure we are properly covering all of your organization's security telemetry * Directory data, so we can learn your organization, your people, their roles, and how to best triage cases or interact with them. * Users' profiles and authentication methods, so we can determine proper guidance for a security detection * File profiles, for enriching files referenced in detections * URL profiles, for enriching URLs referenced in detections * Risk detection and information, because posture related information informs and correlates with detections * Threat & Vulnerability management information, which informs and enriches detections * Security Baseline Assessment data, which informs and enriches detections * Remediation tasks, so we can know what tasks you completed and make better recommendations * Mailbox settings (`MailboxSettings.Read` on read-only integrations), so we can inspect mailbox rules during investigations. This permission does not allow sending or reading of emails. ### Write Access There are a handful of write permissions that we request, so that we can enable the best outcomes and experience for you. All of these are requested at the time of integration, but that does NOT mean they will be used until you opt into configuration settings that leverage these permissions. However, it's a better user experience to request these permissions once, even if you don't enable them within our platform. By default, these are blocked when your tenant is first created in test mode. * Risk detections, so we can update statuses (e.g. close resolved instances or false positives) * Security Alerts, so we can update statuses of the "ticket" portion of alerts and keep them in sync with our triage and response results * Users' authentication methods (`UserAuthenticationMethod.ReadWrite.All`), so **Require MFA Re-enrollment** can remove a compromised user's registered MFA methods. This is a destructive, one-shot remediation: Wirespeed cannot restore deleted methods, and the user must register new methods at the next sign-in that requires strong authentication. * Timeline events, so we can sync our case triage timelines with the timelines in the tickets of your detections within your Microsoft console * All machine information, so we can add comments and metadata to machines for your administrators to see as part of response ### Remediation Access Lastly, there are a small set of permissions that we request, so that we can properly remediate threats on your behalf, whether automated (if you opt-in and enable it), or manually (i.e. you click the remediate button within our application to initiate a remediation process). Just like the Write Access permissions above, none of these are enabled in our platform by default. In test mode, automated remediation is blocked; manual remediation is still available when you click the remediate button. * Enable/Disable user accounts, so that we can remediate a compromised identity during a case, whether automated through user remediation options or manually by clicking the remediate button within our platform. The result is the Microsoft user account is disabled or enabled; this action is completely safe and reversible, either in-platform through the remediate button, or directly in your preferred Microsoft user management tools. * Revoke all sign in sessions; in the case of an identity compromise, an unauthorized threat actor can persist with the access of your compromised user, even after the user's credentials have been reset, by leveraging long-lasting sign in session tokens & cookies. This allows us to revoke all sign-ins, which kills threat actors' access to user accounts. This is a safe and largely reversible action, i.e. the affected user can simply authenticate again to establish new sessions. At most, this is a minor inconvenience to users, in exchange for swift and complete remediation of a hostile threat actor bent on reaching a malicious objective, like BEC or ransomware. * Require MFA re-enrollment by removing the user's registered MFA methods. Wirespeed preserves password, email recovery, and temporary access pass methods to avoid locking the user out. Deleted MFA methods cannot be restored, and the user must register new methods at the next sign-in that requires strong authentication. This action requires `UserAuthenticationMethod.ReadWrite.All` and is unavailable when the integration is configured as read-only. * Run live response on a specific machine; this allows us the ability to perform additional telemetry collection, threat hunts, and thorough response actions by checking for a threat actor's possible persistence on an endpoint in your fleet. * Restrict code execution; this grants us the ability to instruct Microsoft Defender for Endpoint (DFE) to take actions to block malicious code that DFE detected, but did not block, within your environment by establishing a rule to prevent its execution, following our endpoint remediation configuration options after we've confirmed the code is hostile. * Stop and quarantine file; this allows us to instruct Microsoft Defender for Endpoint (DFE) to stop a malicious process and quarantine the malicious files associated with it, when DFE only detects, but does not outright block the threat, following our endpoint remediation configuration options after we have confirmed the suspected threat is in fact malicious. Restoring quarantined files must be done manually in the Defender portal; MDE does not expose a REST API for automatic unquarantine. * Delete mailbox rules (`MailboxSettings.ReadWrite`); this allows us to remove malicious mailbox forwarding rules and other mailbox rules found during investigations. This permission does not allow sending or reading of emails. * Remove malicious Entra applications (`Application.ReadWrite.All`); this allows us to delete third-party applications added by attackers to maintain persistence in your tenant. * Revoke malicious application grants and consents (`DelegatedPermissionGrant.ReadWrite.All`); this allows us to remove attacker-granted OAuth permissions and consents without deleting the entire application. * Add Microsoft Defender IOCs (`Ti.ReadWrite.All`); this allows us to publish indicators of compromise to Microsoft Defender as a remediation action during investigations. ### Limiting Permissions If, after reading and understanding the above about how and why the permissions are required, you would still like to reduce the permissions farther, you can: * Complete the oAuth dialog for the Microsoft integration to Wirespeed, accepting the permission list as presented. * Go to Azure > Enterprise Applications > Wirespeed and remove individual permissions (e.g. write or remediation access) as a hard stop beyond the layers of controls present in Wirespeed. * Document the removed permissions, so that you can re-enable them manually, should you want to enable write/remediation access later. Wirespeed will report errors when attempting certain functions, but it may not be readily apparent to us that the cause for the error is manually edited permissions. * Alternatively, you can choose to update the Microsoft integration later, accepting all of the permissions. You can do this in Wirespeed by going to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Microsoft and following the same process you did originally, without removing the permissions afterwards. This will update your permissions and retain your existing Microsoft data. ### Allow-listing Wirespeed emails You can add certain domains and email addresses to an allow-list across your Microsoft Tenant. To ensure Wirespeed emails get to your team: 1. Go to the [Microsoft Defender Portal](https://security.microsoft.com). 2. Under the **Email & Collaboration** panel on the left, navigate to **Policies & rules**. 3. Select **Threat policies**. 4. Under **Rules** select **Tenant Allow/Block Lists**. 5. With **Domains & addresses** selected, click **Add** and select **Allow**. 6. Add **[wirespeed.co](https://wirespeed.co)** to the dialogue box, leaving the **Remove allow entry after** set to the maximum 45 day time to live. 7. Complete the form by clicking **Add**. On first sync, Wirespeed fetches detections from up to the last **120 days** across Microsoft detection sources. Microsoft Defender alert ingestion on first sync is additionally capped at the newest **5,000** alerts. # Microsoft On-Prem Active Directory Source: https://docs.wirespeed.co/integrations/microsoft-on-prem-active-directory Active Directory integration when 100% on-premises This is only needed if your organization does not already have at least a hybrid Entra (Azure Active Directory) instance. Wirespeed uses directory data to learn your organization, understand user personas when triaging alerts, and confirm metadata. This guide will help an organization with an on-premises only Active Directory instance deploy a FREE Entra (Azure Active Directory - AAD) sync instance which can be used with Wirespeed without any additional charge to your organization. ## Integration Instructions ### 1. Prepare the On-Premises Environment 1. Identify a Server to run Azure AD Connect (can be a domain-joined Windows Server, ideally 2016+). 2. Check Requirements: * .NET Framework 4.7.2 or later * PowerShell 5.1 or later * Internet access from the server 3. Ensure you have an admin account in both: * On-prem AD (for reading users/groups) * Azure AD tenant (global admin) ### 2: Create a Free Azure AD Tenant 1. Go to [Azure Portal](https://portal.azure.com). 2. Click Azure Active Directory → Create a tenant → Azure AD (Free). 3. Enter organization name, domain, region. 4. After creation, note the tenant ID. > Free tier supports up to 500,000 objects, enough for most customers. ### 3: Install Azure AD Connect 1. Download [Azure AD Connect](https://www.microsoft.com/en-us/download/details.aspx?id=47594). 2. Run the installer on your chosen server. 3. Choose Customize (for more control) or Express Settings if you just need directory sync. 4. Authentication Method: * To limit secure password storage to your on-premises instance only, choose "Pass-through Authentication" * "Password Hash Sync" may be chosen to securely replicate hashes of passwords to Entra, but is not required for our integration 5. Connect to your **on-prem AD** and your **Azure AD tenant**. 6. Select the OUs you want to sync * NOTE: this must include every computer and user object that Wirespeed is monitoring 7. Complete the setup and **run an initial sync**. ### 4: Verify the Sync 1. Log into Azure AD portal → Users → All Users. 2. Ensure your on-prem users appear in the cloud tenant. 3. Optional: Check that groups and metadata (like department, job title) are synced. ### 5: Maintain Sync * Azure AD Connect syncs automatically every 30 minutes by default. * You can force sync via PowerShell if needed: ``` Start-ADSyncSyncCycle -PolicyType Delta ``` ### Continue Integrations * Continue with the [Microsoft](microsoft) integration to sync your on-premises directory via Entra to Wirespeed. * Follow the [Microsoft Windows](microsoft-windows) integration guide to collect and send on-premises logs to Wirespeed. # Microsoft Entra Sign-in Logs Source: https://docs.wirespeed.co/integrations/microsoft-sign-in-logs Ingest sign-in logs from Microsoft Entra ID This is only needed if your organization does not have Entra ID Protect Plan 1 or higher. If you have Entra IDP P1 or higher Wirespeed's default Microsoft integration will ingest sign-in logs. Non-interactive and service principal sign-ins are not ingested. Wirespeed only processes interactive user sign-in data from this flow. The same limitation applies to sign-in visibility when using the main Microsoft integration with Entra ID P1 or higher. Wirespeed uses Entra ID's data export settings to forward that interactive user sign-in stream to a customer-owned storage blob, which is synced every minute. A 5-10 minute delay between a sign in occurring and Microsoft publishing it to the storage account is common. ## Integration Instructions ### 1. Create Storage Account 1. Log into [https://portal.azure.com](https://portal.azure.com) 2. Search for **Storage Accounts** 3. Click create and provide the following options: 1. **Subscription**: Choose a subscription for the storage account 2. **Resource Group**: Any resource group can be selected 3. **Storage account name**: Provide a name for the storage blob 4. **Region**: Any region, US - West preferred 5. **Primary Service**: Azure Blob Storage 6. **Performance**: Standard 7. **Redundancy**: Locally-redundant storage 8. Logs are short-lived in these storage blobs, however you may choose Geo-redundant storage if you would like 4. Review + Create > Create ### 2. Create Lifecycle Policy We want to automatically expire logs after a certain period so that you aren't paying for them after they've been ingested by Wirespeed. Wirespeed syncs logs every minute, but it's common to set retention between 1-7 days. Wirespeed does not delete logs in your storage accounts after ingestion, which is why a lifecycle policy is used. 1. Navigate to the Storage account that was created 2. Select **Data Management** > **Lifecycle management** 3. Click add a rule and provide the following options: 1. **Rule name**: Provide a name for the rule 2. **Rule scope**: Apply rule to all blobs in your storage account 3. **Blob type**: Append blobs 4. **Blob subtype**: Base blobs 4. Click next 5. If Base blobs were Last modified more than N days ago then Delete the blob 1. Any value where N>=1 day is acceptable ### 3. Forward Logs 1. Search for **Sign-in Logs** in the Azure Portal 2. Select **Export Data Settings** 1. Provide a **Diagnostic setting name** 2. Select **Add a diagnostic setting** 3. Logs > Categories > **SignInLogs** 4. Destination details > **Archive to a storage account** 5. Select storage account from **Step 1** 3. Click Save ### 4. Integrate with Wirespeed 1. Navigate to the storage account from Step 1 2. Select **Security + networking** > **Access keys** 3. Copy the **connection string** for **key1** 4. Login to Wirespeed and navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Microsoft Entra Sign-in Logs 5. Provide your storage account name and connection string After integrating, it's normal to see warnings in our integration logs saying "Failed to list blobs from container" or "the specified container does not exist". Microsoft does not publish logs immediately, so this warning will be present until logs are published. ## Cost TL;DR: You can expect to pay \<\$5/mo There is a minimal cost associated with this integration due to it being hosted in your account and not ours. You can calculate your costs using the below information. In the below calculations, we assume the average size of a sign-in event which is **5kb**. ### API Read Operations We call the **List and Create Container** endpoint every minute, this endpoint has an associated cost of **\$0.05** per **10k** requests ([source](https://azure.microsoft.com/en-us/pricing/details/storage/blobs/)). For the duration of a month, this totals **\~45k** API requests, totaling **\$.225/mo**. ### API Write Operations This cost is dependent on Microsoft and how often they write to your storage account. If we assume they write once a minute at **\$0.0228** per **10k** write requests ([source](https://azure.microsoft.com/en-us/pricing/details/storage/blobs/)), for **\~45k** monthly requests, we get a total of **\$.1026/mo**. ### Data Storage With a lifecycle policy of **1 day** and **1 million monthly sign-in events**, 33k daily sign-in events would be stored at any given time. `33k events * 5KB/event = 165,000KB = .165GB` stored at any given time. With a storage rate of **\$0.15/GB** ([source](https://azure.microsoft.com/en-us/pricing/details/storage/blobs/)) this would total **\$.02475/mo**. ### Data Egress Azure charges for data leaving their network. While downloading from the account itself is free, you are charged for network egress at a rate of **\$.08/GB** ([source](https://azure.microsoft.com/en-us/pricing/details/bandwidth/)). Sign-in events are **\~5kb** per event, which totals **\~200k** sign-in events per GB. For an organization with **1 million monthly sign-in events**, you can expect to pay **\$.40/mo**. If you observe otherwise in your environment please contact support. # Microsoft Teams Source: https://docs.wirespeed.co/integrations/microsoft-teams Message users directly in Teams ## Installing the Teams App To enable direct messaging to users, you must upload the Wirespeed app to your Microsoft Teams tenant. Microsoft is retiring the legacy integration method Wirespeed previously used for ChatOps through Microsoft Teams. If you are using the legacy Teams integration, update to this integration by May 31, 2026 to avoid losing Teams ChatOps functionality in Wirespeed. ### 1. Download the App Package 1. Download wirespeed-teams-app.zip ### 2. Enable Custom App Uploads 1. Navigate to [admin.teams.microsoft.com](https://admin.teams.microsoft.com) and sign in with your Microsoft 365 administrator credentials 2. In the left-hand menu, select **Teams apps** > **Manage apps** 3. Click **Actions** > **Org-wide app settings** in the upper-right corner 4. Toggle **Let users install and use available apps by default** to **On** 5. Click **Save** It may take up to 24 hours for this setting to take effect. ### 3. Upload the Wirespeed App 1. Click **Actions** > **Upload** and select **Upload custom app** 2. Select the `wirespeed-teams-app.zip` file you downloaded earlier 3. The app will appear in the list with the status "Allowed" ### 4. Grant Permissions 1. Return to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > Microsoft Teams 2. Confirm you have uploaded the ZIP file 3. Add Integration # Microsoft Windows Source: https://docs.wirespeed.co/integrations/microsoft-windows Centralizing and forwarding Microsoft Windows telemetry ## Getting Started Wirespeed supports ingesting Windows logs and telemetry with a free, agentless architecture: 1. [WEF](#wef-windows-event-forwarding) (Windows Event Forwarding) on endpoints with logs you want 2. [WEC](#wec-windows-event-collection) (Windows Event Collector) on a single server 3. [Winlogbeat](#winlogbeat): to read WEC logs (e.g., from the `ForwardedEvents` log) and send them to Logstash 4. [Logstash](#logstash): to forward logs from Winlogbeat to Wirespeed over HTTPS WEF (many hosts) pushes logs → WEC (a single server) gathers and forwards logs → Logstash → Wirespeed Before you configure Logstash, follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Windows Event Logs** and open **Forwarder Details**. Use the HTTPS listener shown there as the Logstash destination. For more information about WEF/WEC, [read this Microsoft article](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection). ### WEF (Windows Event Forwarding) **WEF** is Microsoft's native (no agent required) method for collecting Windows logs and telemetry to send to a centralized location. Typically this is from on-premises or private cloud Windows servers, but this could include high value Windows endpoints as well. We call these systems **source systems** in the context of this documentation. ### WEC (Windows Event Collection) **WEC** is Microsoft's native (no agent required) method for centrally collecting logs from source systems. In a simple architecture, there will be a single WEC Server within an on-premises or private cloud environment that will serve as the WEC Server. This should not be a Domain Controller (those are WEF source systems instead). ### Winlogbeat **Winlogbeat** is one of many [Beats](https://www.elastic.co/beats) Elastic provides for shipping data. Winlogbeat ships Windows event logs to Elasticsearch or Logstash and can be installed as a Windows service. ### Logstash Logstash is an open source server-side data processing pipeline that can ingest data from a multitude of sources, transforms it, and then sends it to a "stash." ## Configure Windows Event Forwarder There are several options for deploying WEF + WEC. Our recommendation uses Group Policy to instruct Windows hosts to push telemetry to the WEC server, rather than pull. You're welcome to use the pull method, but that's not in this documentation. 1. Open Group Policy Management 1. On a domain controller or admin workstation, run gpmc.msc. 2. Create a new GPO (Group Policy Object) 1. Right-click the OU where your servers reside (e.g., `Servers OU`) → **Create a GPO in this domain**, and Link it here. 2. Name: `Windows Event Forwarding`. 3. Right-click the GPO > **Edit**. 3. Enable WinRM Service (Without Remote Management) 1. Computer Configuration > Policies > Windows Settings > Security Settings > System Services. 1. Set Windows Remote Management (WS-Management) to **Automatic**. 2. \*\*\[OPTIONAL] \*\*Wirespeed recommends you block incoming WinRM network traffic on any Windows endpoints where it is not needed, as this enables an avenue for lateral movement by attackers. That said, the WEC Server must have this enabled, so if you do make this change, separate your WEC server into a different OU where this Group Policy setting does not affect it. 1. Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service. 2. Set to **Disabled** 4. Define the WEC Server Address 1. Computer Configuration > Policies > Administrative Templates > Windows Components > Event Forwarding. 2. Enable the setting and put the following into the **Option** field: `Server=http://WEC-Server01.domain.local:5985/wsman/SubscriptionManager/WEC,Refresh=60` 3. Replace `WEC-Server01.domain.local` with your WEC server's FQDN. Port `5985` is the standard for WinRM over HTTP. Port `5986` is standard for WinRM over HTTPS, but this requires a proper internally-deployed TLS Certificate Authority in your Active Directory environment so that all endpoints can trust the HTTPS certificates. Without a proper PKI, leave this as `5985` over HTTP. 5. Enable PowerShell Logging and Transcription 1. Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell 2. Enable **Turn on PowerShell Script Block Logging** 1. Check `Log script block invocation start/stop events` (4105/4106) 3. Enable **Turn on Module Logging** 1. Set `Module Names` to `*` 4. Enable **Turn on PowerShell Transcription** 1. **Transcription Output Directory**: **Leave blank** (defaults to `%UserProfile%\Documents\PowerShell_transcripts`) 2. Check **Include invocation headers**. 5. Enable **Turn on PowerShell Remoting Transcription** (if available) 1. **Transcription Output Directory**: **Leave blank** (defaults to `%UserProfile%\Documents\PowerShell_transcripts`) 2. Check **Include invocation headers**. 6. **Enable Command Line Logging** 1. Computer Configuration > Policies > Administrative Templates > System > Audit Process Creation 2. Enable **"Include command line in process creation events"** 1. This populates the CommandLine field in Security Event ID 4688 for all process creations 7. Define Minimum Logging 1. Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking 1. Enable **Audit Process Creation** 1. Set to **Success** (Event ID 4688 for PowerShell invocation) 2. Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Logon 1. Enable **Audit Kerberos Authentication Service** 1. Set to **Success** and **Failure** (Event IDs 4768, 4771) 2. Enable **Audit Kerberos Service Ticket Operations** 1. Set to **Success** and **Failure** (Event ID 4769) 3. Enable **Audit Other Account Logon Events** 1. Set to **Success** and **Failure** (Event ID 4776) 3. Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Logon/Logoff 1. Enable **Audit Logoff** 1. Set to **Success** (Event ID 4634 for session termination) 2. Enable **Audit Other Logon/Logoff Events** 1. Set to **Success** and **Failure** (Event IDs 4648, 4778, 4779, 4800, 4801) 4. Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies 1. **Audit Logon**: Enable **Success** and **Failure** to cover local, interactive, and remote logon types (e.g., RDP, network). 2. **Audit Account Lockout**: Enable **Success** and **Failure** 3. **Audit Special Logon**: Enable **Success** (privileged logons, e.g., admin rights) 4. **Audit User Account Management**: Enable **Success** and **Failure** (user creation, changes) 5. **Audit Security Group Management**: Enable **Success** and **Failure** (group creation, changes) 6. **Audit Audit Policy Change**: Enable **Success** and **Failure** (audit policy modifications) 7. **Audit Security System Extension**: Enable **Success** and **Failure** (log settings changes) 8. **Privilege Use**: \[Recommendation] Disabled or **Failure** only (Event IDs 4673, 4674) 9. **Process Creation**: \[Recommendation] Enabled **Success** (Step 6, Event ID 4688) 10. **File and Registry Access (Object Access)**: \[Recommendation] **Disabled** or **Failure** only (Event IDs 4656, 4663) 1. \[Optional] If needed, enable selectively via SACLs on specific objects (out of scope) 8. **Enable Task Scheduler Logging** 1. Computer Configuration > Policies > Administrative Templates > Windows Components > Task Scheduler 2. Enable **"Turn On logging for task registration"** 1. This generates events for scheduled task creation, modification, and execution (Event IDs 106, 200, 201) ## Configure Windows Event Collector 1. Identify a server (should match the server identified and set in group policy above), which must run a supported Windows Server release (Server 2016 or newer). If you follow our recommendations above to disable WinRM incoming traffic on the monitored Windows hosts, make sure that setting does NOT apply to the WEC server, or WEC will not work. 2. Download `WEC-Setup.ps1` from Wirespeed's Github: [https://github.com/WirespeedSecurity/utils/](https://github.com/WirespeedSecurity/utils/) 3. Create the directory `C:/Program Files/Wirespeed` and move the script there. Open a powershell terminal running as an administrator in this directory and execute the script with `./WEC-Setup.ps1`. This script will: 1. Enable and configure the Windows Remote Management (WinRM) service: a dependency for WEC. 2. Set the Windows Event Collector service (`wecsvc`) to start automatically and start it immediately using `wecutil qc`. 3. Add the `NT AUTHORITY\Network Service` account to the local `Event Log Readers` group to ensure the proper permissions for event collection. 4. Create firewall rules to allow inbound traffic on ports 5985 (WinRM over HTTP) and 5986 (WinRM over HTTPS) for WEF communication. 5. Configure the WEC server to forward its own Windows events to itself (localhost) via HTTP on port 5985, enabling self-monitoring by setting the registry key `HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager`. 6. Create a source-initiated WEC subscription named "Security and PowerShell Events" to collect events from the Security, Microsoft-Windows-PowerShell/Operational, Windows PowerShell, System, and Application logs, using HTTP and storing events in the ForwardedEvents log. 4. To validate the configuration: 1. Check the `ForwardedEvents` log in Event Viewer (`eventvwr.msc`) on the WEC server to confirm that events from source systems (and the WEC server itself) are being collected. 2. Review the setup log at `C:\Program Files\Wirespeed\collector.log` for any errors or confirmation of successful configuration steps. 3. Generate a test event on a source system (e.g., `eventcreate /Id 500 /D "Test event" /T ERROR /L System`) and verify it appears in the WEC server's `ForwardedEvents` log. All of the script's actions and errors are recorded in a log file at `C:\Program Files\Wirespeed\collector.log` for any additional validation or debugging required. ## Configure Log Forwarding For more information, reference the official documentation for [Winlogbeat](https://www.elastic.co/docs/reference/beats/winlogbeat/) and [Logstash](https://www.elastic.co/docs/reference/logstash). ### Installing and Configuring Winlogbeat Installation is based on Elastic's official [Winlogbeat installation guide](https://www.elastic.co/docs/reference/beats/winlogbeat/winlogbeat-installation-configuration). 1. Download and install Winlogbeat 1. Download the zip file from the [downloads page](https://www.elastic.co/downloads/beats/winlogbeat) 2. Extract the contents into `C:\Program Files` 3. Rename the `winlogbeat-` directory to `Winlogbeat` 4. Open a PowerShell prompt as an Administrator (right-click on the PowerShell icon and select Run As Administrator) 5. From the PowerShell prompt, run the following commands to install the service 1. `cd 'C:\Program Files\Winlogbeat'` 2. `.\install-service-winlogbeat.ps1` If script execution is disabled on your system, you need to set the execution policy for the current session to allow the script to run. For example: `PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-winlogbeat.ps1`. 1. Configure Winlogbeat 1. In `winlogbeat.yml`, replace the existing contents with the configurations below: ```yaml theme={null} winlogbeat.event_logs: - name: Security ignore_older: 72h - name: System ignore_older: 72h - name: Application ignore_older: 72h - name: Microsoft-Windows-PowerShell/Operational ignore_older: 72h - name: ForwardedEvents ignore_older: 72h output.logstash: hosts: ["localhost:5044"] ssl.enabled: false codec.json: pretty: false ``` This is a very basic configuration. It's recommended to learn more about Winlogbeat configuration options and tailor the above to meet your specific needs. Please see [Elastic's official documentation](https://www.elastic.co/docs/reference/beats/winlogbeat/configuring-howto-winlogbeat) for all available configuration options. ### Installing and Configuring Logstash Logstash requires one of the following: * Java 17 * Java 21 1. Download and install Logstash 1. Download the zip file from the [downloads page](https://www.elastic.co/downloads/logstash) 2. Extract the contents into `C:\Program Files` 3. Rename the `logstash-` directory to `Logstash` 4. Navigate to the `C:\Program Files\Logstash\config\` directory 2. Configure Logstash 1. Open **Forwarder Details** for your Windows Event Logs integration and copy the HTTPS domain and listener port 2. Edit `logstash.conf` to gather events from Winlogbeat to ship to Wirespeed: 1. Replace the contents of the existing `logstash.conf` with the contents below (or create if none exists): ``` input { beats { port => 5044 ssl_enabled => false } } filter { # Fix the field reference - use winlog.event_id for Windows events if [winlog][event_id] { mutate { add_field => { "event_id" => "%{[winlog][event_id]}" } } } # Alternative field paths depending on your beat version if [event][code] { mutate { add_field => { "event_id" => "%{[event][code]}" } } } } output { http { url => "https://:" http_method => "post" codec => "json" } } ``` 2. Replace `` and `` with the values from **Forwarder Details** 3. Edit `logstash.yml` to recognize the new configuration by default 1. Append the following lines to the file, then save it and close: ```yaml theme={null} config.reload.automatic: true # Automatically reload config if logstash.conf changes path.config: "C:\\Program Files\\Logstash\\config\\logstash.conf" # Sets the default config file ``` This is a very basic configuration. It's recommended to learn more about Logstash configuration options and tailor the above to meet your specific needs. Please see [Elastic's official documentation](https://www.elastic.co/docs/reference/logstash) for all available configuration options. 4. Install Logstash as a Service It's recommended to run logstash manually to ensure the configuration is valid prior to running as a service. See more information here: [Running Logstash Manually](https://www.elastic.co/docs/reference/logstash/running-logstash-windows#running-logstash-windows-manual) **Recommended:** Read more about this setup here: [Running Logstash as a service with NSSM](https://www.elastic.co/docs/reference/logstash/running-logstash-windows#running-logstash-windows-nssm) 1. Download and install NSSM 1. [https://nssm.cc/download](https://nssm.cc/download) and extract `nssm.exe` from `nssm-\win64\nssm.exe` to `Logstash\bin\` 2. Use NSSM to create Logstash service 1. Open a PowerShell terminal as an administrator and run the following command to install Logstash as a service: 1. `cd "C:\Program Files\Logstash\bin"` 2. `.\nssm.exe install logstash` 2. Once the `NSSM service installer` window appears, specify the following parameters in the `Application` tab: 1. **Path**: `C:\Program Files\Logstash\bin\logstash.bat` 2. **Startup Directory**: `C:\Program Files\Logstash\bin` 3. Click **Install Service** and then **Ok** 5. Start Logstash and WinLogbeat: 1. `Start-Service logstash` 2. `Start-Service winlogbeat` 3. Verify the services are running with 1. `Get-Service Logstash` 2. `Get-Service winlogbeat` 6. Contact a Wirespeed engineer via in-platform chat or by emailing [support@wirespeed.co](mailto:support@wirespeed.co) to ensure logs are flowing as expected # Mimecast Source: https://docs.wirespeed.co/integrations/mimecast Integrate with Mimecast to pull email alerts into Wirespeed ## Integrate Wirespeed with Mimecast 1. Login to **Mimecast** 2. Click **Account** on the left sidebar 3. Select **Admin Roles** 4. Click **New Roles** 5. Name the new role **Wirespeed API** 6. Fill in a description 7. Under **Application Permissions**, enable these permissions: * **Monitoring | URL Protection | Read** * **Monitoring | Impersonation Protection | Read** * **Monitoring | Attachment Protection | Read** * **Security Events and Data Retrieval | Threat and Security Statistics | Read** 8. Click **Save & Exit** 9. Click **Integrations** in the left sidebar 10. Select **API and Platform Integrations** 11. Locate **Mimecast API 2.0** and click **Generate Keys** 12. Check the **I Accept** box and click **Next** 13. Fill out the Application Details: * Name: **Wirespeed** * Category: **Managed SOC Integration** * Products: select **Threats, Security Events and Data for CG**, **Audit Events**, and **Security Events** * Role: select the **Wirespeed API** role you created earlier * Description: give it a user friendly description 14. Click **Next** 15. For **Notifications**, enter your name and email. 16. Click **Save** 17. Copy the **Client Id** and **Client Secret** 18. Log into Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 19. Enter your **Client Id** and **Client Secret** 20. Click **Integrate** On first sync, Wirespeed fetches threat events from the last **2 hours**. # Netskope Source: https://docs.wirespeed.co/integrations/netskope Ingest SSE alerts, web/SaaS/ZTNA/network events, and users from Netskope Netskope is currently in **beta** Wirespeed connects to your Netskope Security Cloud tenant with a REST API **v2** token. This is the SSE/SASE product (`*.goskope.com`), not Device Intelligence. ## Prerequisites * A Netskope tenant hostname (for example `company.goskope.com` or `company.eu.goskope.com`) * A REST API v2 token from a **Service Account** whose role has **View** on: * **Skope IT → Alerts** * **Skope IT → Application Events** * **Skope IT → Network Events** * **Skope IT → Page Events** (HTTP connection / page events) * **Administration → Users & Groups** * If the tenant uses an IP allowlist (**Settings → Administration → IP Allowlist**), add Wirespeed egress IPs to the custom list ## Create a REST API v2 token 1. Log in to the Netskope tenant 2. Open **Settings → Administration → Administrators & Roles → Roles** and create a role with **View** on the functional areas listed above. Set every other permission to **None** 3. Open the **Administrators** tab, click **Service Account**, assign that role, and generate a REST API token 4. Copy the token when it is shown. It is not displayed again On older tenants that still have **Settings → Tools → REST API v2 → New Token**, create a token there and add **Read** on: * `/api/v2/events/dataexport/events/alert` * `/api/v2/events/dataexport/events/application` * `/api/v2/events/dataexport/events/page` * `/api/v2/events/dataexport/events/network` * `/api/v2/scim/Users` instead of using a Service Account role. ## Add the integration in Wirespeed 1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Netskope** 2. Enter the **Tenant Hostname** (for example `company.eu.goskope.com`). A full tenant URL also works 3. Paste the REST API v2 token 4. Submit the integration ## What Wirespeed ingests | Source | Netskope API | Purpose | | - | - | - | | Alerts | `GET /api/v2/events/dataexport/events/alert` | Detections (malware, DLP, policy, malsite, anomaly, and related alert types) | | Application events | `GET /api/v2/events/dataexport/events/application` | SaaS / CASB activity logs | | Page events | `GET /api/v2/events/dataexport/events/page` | Web proxy / HTTP connection logs | | Network events | `GET /api/v2/events/dataexport/events/network` | Network / firewall-style logs | | Users | `GET /api/v2/scim/Users` | Directory sync | On first sync, Wirespeed backfills about **24 hours**, then continues from where the previous pull left off. # NinjaOne Source: https://docs.wirespeed.co/integrations/ninjaone Ingest NinjaOne activities and devices NinjaOne is an RMM/MDM platform. To integrate it, create an API application in NinjaOne and provide the resulting **Client ID** and **Client Secret** to Wirespeed. ## Prerequisites * NinjaOne administrator access * The ability to create an API application under **Administration > Apps > API** * Your NinjaOne instance host (e.g. `app.ninjarmm.com`, `us2.ninjarmm.com`, `eu.ninjarmm.com`, `oc.ninjarmm.com`, or `ca.ninjarmm.com`) ## Create API Credentials 1. Log in to your NinjaOne instance 2. Open **Administration > Apps > API** 3. Click **Add** to create a new API application 4. Configure the client application: * **Application Platform**: Select **API Services (machine-to-machine)** * **Name**: Enter a descriptive name, such as `Wirespeed` * **Redirect URIs**: Leave blank * **Scopes**: Select **Monitoring**. Wirespeed does not require **Management** or **Control** * **Allowed grant types**: Select **Client credentials**. Wirespeed does not require **Authorization code** or **Refresh token** 5. Click **Add** 6. Copy the **Client ID** and **Client Secret** ## Add the Integration in Wirespeed 1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **NinjaOne** 2. Enter your **Instance Domain**, **Client ID**, and **Client Secret** 3. Submit the integration 4. Select the NinjaOne organizations to ingest, or leave the selection blank to ingest all organizations ## Separating MSP/MSSP clients NinjaOne issues a single API credential per instance that can see **every** organization, so it does not provide per-client API keys. To keep each of your clients isolated in Wirespeed, scope each integration to that client's NinjaOne organization(s): 1. Create one Wirespeed client team per NinjaOne organization (or group of organizations) 2. Add the NinjaOne integration on each client team, reusing the **same** Instance Domain, Client ID, and Client Secret 3. Select that client's organizations during setup Wirespeed then scopes both the activity and device syncs to those organizations for each team. Leave the selection blank to ingest all organizations into a single team. ## What Wirespeed Ingests | Source | NinjaOne API | Purpose | | - | - | - | | Activities | `GET /v2/activities` | RMM/MDM telemetry (jobs, conditions, patch, remote sessions) | | Devices | `GET /v2/devices-detailed` | Managed device inventory for asset correlation | # Odoo Helpdesk Source: https://docs.wirespeed.co/integrations/odoo-helpdesk Integrate with Odoo Helpdesk to automatically create and manage tickets from Wirespeed cases and detections ## Prerequisites Before connecting Wirespeed to Odoo Helpdesk, ensure the following: * Your Odoo instance is running **Odoo 19 or later** — the JSON-2 API required by this integration is only available in v19+. * The **Helpdesk** app is installed in your Odoo instance. * **Odoo SaaS (odoo.com) only** — the integration currently accepts instance hostnames under `*.odoo.com` (for example `yourcompany.odoo.com`). **Self-hosted Odoo** on a custom domain or hostname is **not supported** at this time. ## Generate an API Key 1. Log in to your **Odoo** instance 2. Click your profile avatar in the top-right corner and select **My Preferences** 3. Go to **Account Security** → **API Keys** 4. Click **New API Key** 5. Enter a description (e.g., `Wirespeed Integration`) and set the key duration to **1 Year** to prevent unexpected authentication failures due to key expiration 6. Click **Generate Key** 7. Copy the generated key immediately — it will not be shown again ## Connect Wirespeed to Odoo Helpdesk 1. Log in to **Wirespeed** 2. Navigate to **Integrations** → **Add Integration** 3. Select **Odoo Helpdesk** and click **Integrate** 4. Fill in the following fields: * **Odoo Instance URL** — the hostname of your Odoo SaaS instance (e.g. `yourcompany.odoo.com`). Must be an `*.odoo.com` hostname; self-hosted instances are not supported yet. * **API Key** — the key generated in the previous step 5. Click **Save** Wirespeed will verify the API key and confirm the Odoo version is 19+. If either check fails, the integration will not be enabled. ## Configure Ticket Behavior After enabling the integration, click **Configure** to set ticket creation preferences. Fields are dependent — select **Database** first, then optionally **Company** to filter the team list, then **Helpdesk Team**. | Setting | Description | | - | - | | **Database** | The Odoo database to use for all API operations (required) | | **Company** | Optionally filter Helpdesk teams by Odoo company. Defaults to Any. | | **Helpdesk Team** | Odoo Helpdesk team to assign new tickets to (required) | | **Stage Mapping** | Maps each Wirespeed case status to an Odoo Helpdesk stage. Wirespeed will attempt to auto-populate this using Odoo's default stage names (New, In Progress, Solved). All statuses must be mapped before saving. | | **Create Tickets for Standalone Detections** | When enabled, tickets are created for detections that are closed and not part of a case | | **Case Ticket Title Template** | Title template for case tickets. Supports variables like `` `sid` `` and `` `title` `` | | **Detection Ticket Title Template** | Title template for detection tickets. Only shown when **Create Tickets for Standalone Detections** is enabled. Supports variables like `` `sid` `` and `` `title` `` | Click **Save** when done. The Save button is disabled until all required fields are filled and all Wirespeed statuses have a stage mapped. ## How It Works * When a Wirespeed case is escalated, a Helpdesk ticket is created in Odoo with priority mapped from severity (Critical → Urgent, High → High, Medium → Normal, Low/Info → Low). * When a case status changes, the Odoo ticket is moved to the corresponding stage based on your configured Stage Mapping. * When a detection is added to a case, a comment is posted on the associated Odoo ticket. * When a Wirespeed case is closed, the ticket stage is updated to the mapped Closed stage and a comment is posted noting the closure. * Ticket title templates support dynamic variables using backtick syntax (e.g. `` `sid` ``, `` `title` ``, `` `severity` ``). # Okta Source: https://docs.wirespeed.co/integrations/okta Ingest all users from your Okta directory We use [Okta's Integration Network](https://www.okta.com/integrations/) (OIN) to integrate with your directory. 1. Log into your Okta account as an administrator 2. Select "Admin" in the top right 3. Select Applications > API Service Integrations > Add Integration 4. Search for **Wirespeed** 5. Click **Add** 6. Copy the Client ID, Client Secret, and Okta Domain 7. Login to Wirespeed and navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Okta and provide the Client ID, Client Secret, and Okta Domain On first sync, Wirespeed fetches detection-eligible security events from the last **7 days**. ## Remediation and release actions When write access is enabled (read-only mode is off), Wirespeed can take the following user remediation and release actions in Okta: | Action | Okta API | Effect | | - | - | - | | **Suspend User** | `POST /api/v1/users/{id}/lifecycle/suspend` | Prevents the user from signing in | | **Unsuspend User** | `POST /api/v1/users/{id}/lifecycle/unsuspend` | Restores sign-in access | | **Revoke Sessions** | `DELETE /api/v1/users/{id}/sessions?oauthTokens=true` | Terminates active sign-in sessions and revokes OAuth tokens | | **Revoke Sessions (Identity Threat Prevention)** | `POST /oauth2/v1/global-token-revocation` | Same Revoke Sessions remediation action; terminates Okta sessions and revokes tokens in connected apps when the Identity Threat Prevention SKU is detected | | **Reset Password** | `POST /api/v1/users/{id}/lifecycle/expire_password` | Expires the current password, forcing a password change on next sign-in | All remediation and release actions require the `okta.users.manage` OAuth scope. Revoke Sessions with Identity Threat Prevention additionally requires the `okta.universalLogout.manage` and `okta.policies.read` scopes. # OneLogin Source: https://docs.wirespeed.co/integrations/onelogin Sync directory users and remediate compromised OneLogin accounts ## Overview Wirespeed connects to OneLogin with OAuth 2.0 client credentials so it can: * Sync directory users for identity correlation and remediation targeting * Suspend compromised users during incident response * Revoke a user's active OneLogin session * Require users to reset their password at their next OneLogin sign-in * Re-enable suspended users when an incident is resolved This integration covers **directory sync and user remediation only**. Event log ingestion is tracked separately. ## Prerequisites Before connecting OneLogin in Wirespeed, gather: * Your **OneLogin subdomain** (for example `https://acme.onelogin.com`) * An API **Client ID** * An API **Client Secret** ## Create API Credentials 1. Sign in to OneLogin as an administrator. 2. Open **Developers** > **API Credentials**. 3. Create a new API credential pair for Wirespeed. 4. Choose a scope: * **Manage users** or **Manage All** if you want Wirespeed to remediate users * **Read Users** or **Read All** is sufficient for directory sync only 5. Copy the **Client ID** and **Client Secret**. The secret may only be shown once. ## Connect OneLogin in Wirespeed 1. In Wirespeed, go to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse). 2. Select **OneLogin**. 3. Enter your **OneLogin Subdomain**, **Client ID**, and **Client Secret**. 4. Save the integration and wait for validation to complete. ## Permissions To remediate users, the API credential must include **Manage users** or **Manage All**. Password-reset remediation marks the user as **Awaiting password reset**, which requires them to reset their password at their next OneLogin sign-in. Session revocation terminates the user's OneLogin session, preventing access to the OneLogin portal and initiation of new SAML or OpenID Connect sign-ins. ## Validation When you enable the integration, Wirespeed validates the credentials by requesting a small page of users from the OneLogin Users API. # OpenAI Platform Source: https://docs.wirespeed.co/integrations/openai Monitor administrative, configuration, and authentication activity across your OpenAI API Platform organization The OpenAI Platform integration collects organization audit logs for security monitoring and detection. It covers administrative changes, API key activity, identity configuration, and login attempts without requiring software on employee devices. This integration connects to the OpenAI **API Platform** at `platform.openai.com`. It does not use ChatGPT Enterprise Admin Console credentials or collect prompt and response content. ## Prerequisites Before setting up this integration, ensure that: 1. You are an **Organization Owner** in OpenAI API Platform 2. You can change organization data controls 3. You can create an API Platform Admin API key ## Step 1: Enable Audit Logging 1. Sign in to [OpenAI Platform](https://platform.openai.com/) 2. Open **Settings** → **Data controls** → **Data retention** 3. Under **Audit logging**, click **Enable** 4. Save your changes Enabling audit logging is effectively one-way. It cannot be disabled in organization settings; an Organization Owner must contact OpenAI Support to request a change. Audit logging must be enabled before OpenAI makes audit records available through the API. OpenAI does not backfill activity from before this setting was turned on. A newly enabled organization can return an empty audit log until someone performs an administrative action after enablement. ## Step 2: Create a Restricted Admin API Key 1. Open [Organization Admin keys](https://platform.openai.com/settings/organization/admin-keys) 2. Click **Create new admin key** 3. Enter a descriptive name, such as `Wirespeed Audit Logs` 4. Under **Permissions**, select **Restricted** 5. Set **Audit Logs Scope** to **Read** 6. Leave unrelated management permissions disabled 7. Create the key and copy it immediately OpenAI displays the key once. If it is lost, delete it and create another key. Store it securely. Use an API Platform Admin key, whose redacted form begins `sk-admin...`. Standard model/project keys and ChatGPT workspace Admin keys cannot access this endpoint. Wirespeed does not require Organization Administration Write. ## Step 3: Connect OpenAI Platform to Wirespeed 1. In Wirespeed, open Integrations → [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Search for and select **OpenAI Platform** 3. Paste the Admin API key 4. Click **Integrate** Wirespeed validates the key against the organization Audit Logs endpoint before enabling the integration. A successful connect only proves the key can call that endpoint. It does not mean events already exist. ## What Events Are Collected? Wirespeed imports all event types returned by the OpenAI organization Audit Logs API, including: * Sign-in and sign-out successes and failures * User, invitation, group, and service account changes * Role and permission assignments * API key creation, updates, and deletion * IP allowlist and SCIM configuration changes * Project, organization, and rate-limit changes * Workload identity, tunnel, certificate, and external-key changes The first sync requests up to seven days of **available** history. Events from before audit logging was enabled are not available. OpenAI retains audit logs on a best-effort basis and does not guarantee a fixed retention period. OpenAI audit logs contain administrative metadata, not model request or response content. OpenAI Zero Data Retention settings do not change audit-log availability. ## Managed Detections Wirespeed evaluates the collected events for: | Detection | Condition | | - | - | | IP allowlist changed | An allowlist is created, updated, deleted, activated, or deactivated | | Owner or admin role assigned | A user or service account receives elevated access | | SCIM configuration changed | SCIM provisioning is enabled or disabled | | Elevated API key | An API key is created with dashboard **All** (empty `scopes`), or created/updated with a `.write` / `:write` / `admin` scope | Successful and failed logins are also normalized as authentication events for SIEM searches and cross-platform login detections. Wirespeed does not create an individual detection for every login. ## Troubleshooting ### Invalid API Key For `401` errors: 1. Confirm that the entire key was pasted without spaces 2. Confirm that it is an API Platform Admin key, not a standard OpenAI API key 3. If the key was deleted or lost, create a replacement and update Wirespeed ### Missing Audit Log Permission For `403` or missing-scope errors: 1. Create the key as an OpenAI API Platform Organization Owner 2. Select **Restricted** permissions 3. Set **Audit Logs Scope** to **Read** 4. Replace the key in Wirespeed ### Integration Connects but No Events Appear A healthy integration with only an "Integration added" log usually means OpenAI returned an empty list. Confirm events exist on the vendor before expecting them in Wirespeed: ```bash theme={null} curl -sS "https://api.openai.com/v1/organization/audit_logs?limit=5" \ -H "Authorization: Bearer $OPENAI_ADMIN_KEY" ``` `"data": []` with `"has_more": false` means there is nothing for Wirespeed to ingest. Then: 1. Confirm audit logging is **Active** under **Data controls** → **Data retention** 2. Create and delete a **project** API key, or sign out and back in 3. Wait a few minutes and rerun the request until `data` contains events 4. Allow one more minute for Wirespeed to poll Do not use the Admin key pasted into Wirespeed as a model key. Project API keys and dashboard session activity are what produce audit records. ### Rate Limiting OpenAI may return `429` responses during high-volume collection. Wirespeed retries collection on a later sync without advancing past the incomplete window. ## Additional Resources * [OpenAI Admin and Audit Logs API](https://help.openai.com/en/articles/9687866-admin-and-audit-logs-api-for-the-api-platform) * [OpenAI Admin APIs guide](https://developers.openai.com/api/docs/guides/admin-apis) * [OpenAI Audit Logs API reference](https://developers.openai.com/api/reference/resources/organization/subresources/audit_logs/) # Orca Security Source: https://docs.wirespeed.co/integrations/orca-security Ingest cloud security alerts from Orca Security 1. Login to **Orca Security** console 2. Navigate to **Settings** > **Users & Permissions** > **API Tokens** 3. Click **Create Token** 4. Name the token (e.g., "Wirespeed") 5. Set appropriate expiration 6. Copy and save the **API Token** 7. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Orca Security** 8. Paste the API Token 9. Select **Add Integration** Orca Security alerts will now appear in Wirespeed. On first sync, Wirespeed fetches alerts from the last **30 days**, capped at the newest **5,000** alerts. # PagerDuty Source: https://docs.wirespeed.co/integrations/pager-duty Integrate with PagerDuty to sync Wirespeed cases as incidents ## PagerDuty and Wirespeed integration benefits * Create PagerDuty incidents automatically when Wirespeed cases are escalated * Route incidents to the PagerDuty service selected during setup * Map Wirespeed case severity to high- or low-urgency PagerDuty incidents * Resolve PagerDuty incidents when their associated Wirespeed cases are closed * Synchronize acknowledgements, resolutions, and notes between PagerDuty incidents and Wirespeed cases ## How it works * When a Wirespeed case is escalated, Wirespeed creates an incident on the configured PagerDuty service. The incident includes the Wirespeed case details and uses the configured case incident title template when one is provided. * Wirespeed maps critical and high-severity cases to high-urgency incidents. Other severities create low-urgency incidents. * When a Wirespeed case is closed, Wirespeed resolves the associated PagerDuty incident. If the case is closed with notes, Wirespeed adds the close note to the incident. * When a detection is added to an escalated Wirespeed case, Wirespeed adds a note to the associated PagerDuty incident. * Wirespeed creates a webhook subscription for the selected PagerDuty service. Through this webhook, resolving an incident closes the associated Wirespeed case, acknowledging an incident marks the case as responded to, and annotating an incident adds a note to the case. ## Requirements * An active Wirespeed account with permission to add and configure integrations * An active PagerDuty account and a PagerDuty user who can access the service used for Wirespeed incidents * Permission to manage incidents and webhook subscriptions for the selected PagerDuty service Wirespeed uses PagerDuty classic OAuth and requests the `write` scope. PagerDuty's classic OAuth `write` scope includes read and write access. Wirespeed requires write access to create and update incidents and manage webhook subscriptions. It requires read access to list available services and existing webhook subscriptions. The integration does not require you to create or enter an API key. PagerDuty issues an OAuth access token after authorization, and Wirespeed stores the token encrypted in its integration credential storage. The connection is tied to the PagerDuty user who authorizes it, so Wirespeed can only access services and perform actions that user is permitted to access. ## Support If you need help with this integration, use the **Chat** button in Wirespeed to contact our engineers or email [support@wirespeed.co](mailto:support@wirespeed.co). ## Integration walkthrough ### In PagerDuty You do not need to create a PagerDuty service integration or copy an integration key. Before starting, confirm that the PagerDuty service you want to use already exists and that your PagerDuty user can manage incidents and webhook subscriptions for it. PagerDuty prompts you to authorize Wirespeed through OAuth during setup. ### In Wirespeed 1. Sign in to Wirespeed and navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **PagerDuty**, then click **Integrate** 3. In the PagerDuty authorization tab, review the requested `write` OAuth scope and click **Accept** to authorize Wirespeed as your PagerDuty user 4. Return to Wirespeed and refresh the [**Integrations**](https://app.wirespeed.co/settings/integrations) page 5. Select the newly added **PagerDuty** integration 6. Select the PagerDuty **Service** where Wirespeed should create incidents 7. Optionally, enter a **Case Incident Title Template** to customize incident titles 8. Click **Save** When you save the configuration, Wirespeed creates a webhook subscription for the selected service and subscribes to `incident.resolved`, `incident.acknowledged`, and `incident.annotated` events. ## How to uninstall 1. Sign in to Wirespeed and navigate to [**Integrations**](https://app.wirespeed.co/settings/integrations) 2. Select the connected **PagerDuty** integration 3. Click **Delete** 4. Enter the requested confirmation text, then confirm the deletion Deleting the integration stops synchronization between Wirespeed and PagerDuty and removes the webhook subscription created by Wirespeed. Existing PagerDuty incidents and Wirespeed cases are not deleted. # Palo Alto Networks Cortex Source: https://docs.wirespeed.co/integrations/palo-alto-networks-cortex Import alerts, manage endpoints, and quarantine or restore files from Cortex XDR/XSIAM ## Integrate Wirespeed with Palo Alto Networks Cortex 1. Log in to your Cortex XDR/XSIAM console 2. Navigate to **Settings** > **Configurations** > **Integrations** > **API Keys** 3. Click **+ New Key** to create a new key * Select **Standard** for security level * Select the **Security Admin** role * (optional) Input an expiration date * Click **Generate** * Copy your **Generated Key** 4. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 5. Select **Palo Alto Networks Cortex** 6. Enter your **API Key** 7. Back in Cortex, locate your **API ID** by finding your new key in the table and locating the **ID** column 8. Add your **API ID** to Wirespeed 9. Back in Cortex, click the **Copy API URL** button 10. Paste the copied URL in the **Domain** field 11. Click **Integrate** On first sync, Wirespeed fetches up to the newest **1,000** alerts from the last **30 days**. # Palo Alto Networks NGFW Source: https://docs.wirespeed.co/integrations/palo-alto-ngfw Forward PAN-OS firewall logs to Wirespeed over syslog ## Set up the Wirespeed forwarder 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Palo Alto Networks NGFW** and open **Forwarder Details** 2. Copy the hostname or IP address and listener port shown by Wirespeed 3. Keep **Forwarder Details** available while configuring PAN-OS ## Create a PAN-OS syslog server profile 1. Sign in to the firewall or Panorama: * On a firewall, go to **Device > Server Profiles > Syslog** * In Panorama, select the template or template stack for the managed firewalls, then go to **Device > Server Profiles > Syslog** 2. Click **Add**, name the profile, and select its virtual-system location when applicable 3. Add a syslog server and enter the Wirespeed hostname or IP address and port 4. Choose the transport configured in Wirespeed: * **TCP** provides reliable cleartext delivery * **SSL** provides reliable encrypted delivery using TLS 1.2 * **UDP** provides connectionless cleartext delivery 5. Select **IETF** format when available. Its timezone-aware header provides a safer timestamp fallback than BSD format 6. Select the facility your organization uses, then save the server profile Leave **Custom Log Format** unset for every forwarded log type. Wirespeed parses Palo Alto's standard positional CSV layouts; selecting, reordering, or adding custom fields changes those layouts. For SSL transport, follow the Wirespeed [Syslog over TLS](/integrations/log-forwarders#syslog-over-tls) guidance. Wirespeed authenticates itself to the firewall with its server certificate but does not request a client certificate from the firewall. Do not enable SSL client authentication. ## Choose which logs to forward You control which PAN-OS log categories Wirespeed receives. You can forward all supported categories, only categories such as Traffic, Threat, or URL Filtering, or a filtered subset of each category. ### Policy-generated logs 1. Go to **Objects > Log Forwarding**. In Panorama, first select the device group for the managed firewalls 2. Add a Log Forwarding profile 3. Add one match-list entry for each desired log type, such as: * Traffic * Threat * URL Filtering * Data Filtering * WildFire Submissions * Authentication * Tunnel Inspection * GTP * SCTP 4. Select the Wirespeed syslog server profile for each entry 5. Optionally add a Palo Alto filter to restrict that log type by severity, verdict, zone, rule, or another available log attribute 6. Attach the Log Forwarding profile to the applicable Security, Authentication, Decryption, DoS Protection, and Tunnel Inspection policy rules 7. For Traffic logs, enable **Log at Session Start**, **Log at Session End**, or both according to your monitoring requirements ### Device-generated logs Go to **Device > Log Settings** and select the Wirespeed syslog server profile for the desired System, Config, User-ID, HIP Match, Correlation, IP-Tag, GlobalProtect, and Audit log settings available in your PAN-OS release. In Panorama, configure these settings in the template or template stack for the managed firewalls. Wirespeed supports the standard Traffic, Threat, URL Filtering, Data Filtering, WildFire, HIP Match, GlobalProtect, IP-Tag, User-ID, Decryption, Tunnel Inspection, SCTP, Config, Authentication, System, Correlated Events, GTP, and Audit syslog layouts. You do not need to enable every type. ## Commit and verify 1. Deploy the PAN-OS configuration: * On a firewall, select **Commit** * In Panorama, select **Commit > Commit and Push** and include the affected device groups and templates 2. Generate an event for each enabled category 3. Confirm that events appear under **Events** in Wirespeed See Palo Alto's official [Configure Syslog Monitoring](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring/configure-syslog-monitoring-pan-os), [Configure Log Forwarding](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/configure-log-forwarding/configure-log-forwarding-pan-os), and [Syslog Field Descriptions](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions) documentation for PAN-OS-version-specific details. # FortiMail Workspace Security Source: https://docs.wirespeed.co/integrations/perception-point Import email threat scans from FortiMail Workspace Security (formerly Perception Point) **FortiMail Workspace Security** (formerly Perception Point) is Fortinet's email threat protection product. API hosts remain on `*.perception-point.io`. Use this integration when you have console access and an Admin API key (including Acronis Email Security tenants with X-ray / FortiMail Workspace Security console access). API access must be included in your license. Confirm with your Fortinet Account Manager if unsure. 1. Login to the **FortiMail Workspace Security** console 2. Confirm your **Environment** under **Settings → Account → Environment** (US, EU, or AUS). This maps to the API host: * US: `api.perception-point.io` * EU: `api.eu.perception-point.io` * AUS: `api.aus.perception-point.io` 3. Navigate to **Settings → Profile → Security → API Key** 4. Copy the **API Key** (Admin role only). Prefer a dedicated Admin user for API access so the token is not tied to an individual operator. 5. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **FortiMail Workspace Security** 6. Paste the **API Key**, select the matching **API Host**, and optionally set **Organization ID** for MSSP/sub-org filtering 7. Select **Add Integration** Wirespeed polls non-clean email scans (`MAL`, `BLK`, `SPM`, `SUS`) and creates detections. Clean (`CLN`) scans are not ingested. On first sync, Wirespeed fetches threat scans from the last **7 days**. # Picus Security Source: https://docs.wirespeed.co/integrations/picus Integrate with Picus Security to verify whether detections are tied to attack simulation activity ## Overview Picus Security is an attack simulation platform that continuously validates your security controls against real-world threats. When integrated with Wirespeed, detections that match active Picus simulations are automatically identified and recategorized — preventing simulated attacks from escalating as real incidents. ## Generate a Refresh Token in Picus 1. Log in to [**app.picussecurity.com**](https://app.picussecurity.com/signin). 2. Click **Settings** in the left sidebar. 3. Select **Rest API Token**. 4. Click **Generate Token**. 5. Copy the refresh token and store it securely — it will not be shown again. Refresh tokens are valid for **6 months**. Wirespeed will automatically regenerate the token before it expires, but if the token becomes invalid you will need to return here and generate a new one. ## Connect Picus to Wirespeed 1. Log in to **Wirespeed**. 2. Navigate to **Integrations** > **Add Integration** > **Picus Security**. 3. Paste your refresh token into the **Refresh Token** field. 4. Click **Integrate**. Wirespeed will exchange the refresh token for a short-lived access token automatically. No base URL or account ID is required. # PingOne Source: https://docs.wirespeed.co/integrations/ping-one Sync PingOne users, ingest audit activities, and remediate accounts ## Prerequisites Before connecting PingOne, make sure you have: 1. Access to the PingOne admin console for the environment you want to monitor 2. A PingOne worker application that can use the `client_credentials` grant 3. The PingOne environment ID for the environment you want Wirespeed to manage 4. Roles assigned to the worker application that allow it to manage directory users and read audit activities ## Step 1: Create a Worker Application 1. Sign in to the PingOne admin console 2. Open the environment you want Wirespeed to monitor 3. Navigate to **Applications** 4. Create a new **Worker** application 5. Enable the `client_credentials` grant type 6. Ensure the **Token Endpoint Auth Method** is set to **Client Secret Basic** (this is the default) 7. Save the application ## Step 2: Assign the Required Access 1. Open the worker application you created 2. Assign the roles needed to: * Manage directory users using the **Identity Data Admin** role at the environment level * Read audit activities for the environment 3. Save the role assignments You can assign **Identity Data Read Only** instead if you only want Wirespeed to sync directory users. Select **Read Only** under advanced options when adding the integration. ## Step 3: Collect the Connection Details From the PingOne admin console, copy the following values: * **Environment ID** * **Client ID** * **Client Secret** * **Region** for the environment Use one of these region codes in Wirespeed: | Region | Code | API Domain | Auth Domain | | - | - | - | - | | North America | `NA` | `api.pingone.com` | `auth.pingone.com` | | Canada | `CA` | `api.pingone.ca` | `auth.pingone.ca` | | European Union | `EU` | `api.pingone.eu` | `auth.pingone.eu` | | Australia | `AU` | `api.pingone.com.au` | `auth.pingone.com.au` | | Singapore | `SG` | `api.pingone.sg` | `auth.pingone.sg` | | Asia-Pacific | `AP` | `api.pingone.asia` | `auth.pingone.asia` | ## Step 4: Add the Integration in Wirespeed 1. Log in to **Wirespeed** 2. Navigate to **Integrations** > **Add Integration** 3. Select **PingOne** 4. Enter the following: * **PingOne Region**: `NA`, `CA`, `EU`, `AU`, `SG`, or `AP` * **Environment ID** * **Client ID** * **Client Secret** 5. Click **Integrate** Wirespeed will exchange your worker application credentials for an access token and begin polling PingOne for new data. During setup, Wirespeed validates that the worker application can read directory users and audit activities for the selected environment. If either required check fails, the integration will not enable. ## What Wirespeed Collects Wirespeed currently ingests the following from PingOne: * Directory users * Audit activities from the PingOne audit reporting APIs ## Remediation Actions With **Identity Data Admin** access, Wirespeed can: * Disable users to prevent authentication * Re-enable users to restore authentication * Force users with PingOne-managed passwords to change their password at next sign-in * Terminate the sessions retained by PingOne for a user Disabling a user does not terminate existing sessions. Session revocation terminates the sessions returned by PingOne, but does not guarantee revocation of every OAuth token. ## Troubleshooting * If authentication fails during setup, confirm the worker application is configured for `client_credentials` with the **Token Endpoint Auth Method** set to **Client Secret Basic** (not Client Secret Post) * If setup fails while validating audit activity access, confirm the selected region and environment ID are correct and the worker application can read audit data in the target environment * If setup fails while validating directory user access, assign **Identity Data Admin** or **Identity Data Read Only** to the worker application at the environment level * If a remediation action fails with a permissions error, confirm the worker application has **Identity Data Admin** access for the user's environment or population * If you are unsure which region to use, verify the PingOne environment's regional domain in the admin console and match it to the table above # Proofpoint Source: https://docs.wirespeed.co/integrations/proofpoint Import Cloud Threat Response message logs and incident detections The Proofpoint integration connects to Cloud Threat Response (CTR) using a Cloud Admin API key and secret. ## Supported data * **Message logs** include sender, recipient, subject, disposition, CLEAR verdict and confidence, TAP threats and campaigns, URLs, attachments, delivery status, remediation status, and related CTR incidents. * **Incident detections** include Proofpoint's incident title, priority, state, assignment, message count, dispositions, verdicts, confidence, source types, and VAP/VIP flags. Sender and recipient values are indexed as user observables. CTR does not provide an authoritative user directory or managed endpoint inventory, so the integration does not synchronize users or endpoints. ## Prerequisites Create a dedicated API key in **Cloud Admin → Settings → API Key Management → Threat Protection**. Save the API key and secret when they are displayed. These credentials are different from the service principal and secret used by the TAP SIEM API. ## Connect Proofpoint 1. In Wirespeed, go to **Settings → Integrations → [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) → Proofpoint**. 2. Enter the CTR **API Key** and **API Secret**. 3. Save and enable the integration. ## Synchronization behavior Message and incident searches use bounded pagination and a three-day initial lookback. Message collection runs at most every five minutes. Cursor state only advances after Wirespeed successfully ingests the corresponding data. CTR message logs remain available for SIEM search and future managed detection rules. Proofpoint incident detections initially use a non-escalating default category until dedicated categorization rules are defined. ## Not included The integration does not retrieve message bodies, MIME content, dashboard reports, People/VAP reports, or TAP SIEM events. Closing or recategorizing a Wirespeed detection does not update the Proofpoint incident. # ReversingLabs Source: https://docs.wirespeed.co/integrations/reversing-labs Automated file enrichment Wirespeed provides a complementary [ReversingLabs](https://www.reversinglabs.com/) integration for all of our clients. This integration is optional (enabled by default) and will send the file hashes from your detections to the RL API to get metadata. Enrichment data will be present in your detection timelines and on the Assets > Files view. # SafeBreach Source: https://docs.wirespeed.co/integrations/safebreach Integrate with SafeBreach to determine whether detections are tied to simulated attacks 1. Login to your **SafeBreath** instance 2. Navigate to **Settings** > **API Keys** 3. Click **Create API Key**, input a name, and click save 4. Copy the **Key** to your clipboard 5. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **SafeBreach** 6. Paste your key in the **API Key** field 7. Back in SafeBreach, at the top of the **API Keys** page you will see a **Base URL** and **Account Id** 8. Paste your **Base URL** and **Account Id** into Wirespeed 9. Click **Integrate**! # Sandfly Source: https://docs.wirespeed.co/integrations/sandfly Ingest Sandfly alert results and sync Linux host inventory for enrichment This integration is currently in beta. Sandfly alert results are ingested as informational events as we finalize more detailed categorization mappings. The Sandfly integration ingests Linux detection results from Sandfly and correlates them to host inventory in Wirespeed. ## What This Integration Does * Ingests Sandfly `alert` results into Wirespeed detections * Syncs Sandfly hosts as endpoint assets * Correlates detections to endpoint inventory in Wirespeed for host context ## Prerequisites Before setup, make sure you have: 1. The **hostname or IP address** of your Sandfly server (reachable from Wirespeed) 2. A dedicated Sandfly API user with read-only access (recommended role: `api_result_read`) 3. The API user's username and password ## Step 1: Create a Read-Only API User in Sandfly In Sandfly, create a dedicated integration user and assign read permissions only (prefer `api_result_read`). Use a dedicated service account for Wirespeed instead of a personal admin account. ## Step 2: Add Sandfly in Wirespeed 1. Go to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Search for **Sandfly** 3. Enter: * **Sandfly Host** (hostname or IP, no protocol/path; for example `sandfly.company.com` or `142.250.190.46`) * **API Username** * **API Password** 4. Click **Integrate** During onboarding, Wirespeed validates: * Credential correctness (`/v4/auth/login`) * API reachability and token validity (`/v4/version`) ## Detection Ingestion Behavior * Only `alert` status results are ingested * `pass` and `error` results are ignored * Whitelisted and superseded results are excluded * Cursor-based polling uses `time_since` to avoid gaps and duplicates ## Endpoint Inventory and Enrichment * Host inventory sync uses Sandfly host summaries (`/v4/hosts?summary=true`) * Host context is attached to detections through Wirespeed endpoint correlation ## Troubleshooting ### Authentication or Validation Failures Check: 1. Hostname/IP is correct and reachable from Wirespeed 2. Wirespeed can reach your Sandfly API over HTTPS 3. Username/password are valid 4. The API user has read access to results and hosts ### No Detections Appearing Check: 1. Sandfly has recent `alert` results (not only `pass`/`error`) 2. Results are not whitelisted or superseded 3. Initial sync may take a few minutes depending on volume ## Additional Resources * [Sandfly API Overview](https://docs.sandflysecurity.com/docs/sandfly-api) * [Sandfly API Reference](https://api.sandflysecurity.com/) # SentinelOne Source: https://docs.wirespeed.co/integrations/sentinel-one Automatically respond to all S1 detections To integrate SentinelOne you will need 2 pieces of information, the URL and the API Key of your SentinelOne account. ## URL SentinelOne uses different subdomains based on your region and who you purchased your licenses from. To get this value, log in to S1 and copy the URL from your address bar. It should look like `https://usea1-011.sentinelone.net/`. Using `console[.]sentinelone[.]net` is not a valid value. ## API Key To create an API Key you'll need to create a service user. SentinelOne offers two console UIs; use the tab that matches the interface you see after logging in. 1. **Settings** > **Users** > **Actions** 2. **Service Users** > **Actions** > **Create New Service User** 3. You may name it anything you'd like; we suggest **Wirespeed** 4. When prompted to **Select Scope of Access**, we recommend **Site** > **Client** for MSP setups so access is scoped to the client being onboarded. 5. Set the expiration to a value you feel comfortable with; we suggest 1 year. When the token expires you will receive an email notification from us saying the integration is experiencing errors. We also suggest setting a calendar reminder to update the token before it expires. In an upcoming release we will automatically notify you ahead of time. 6. Copy the API token and paste it into Wirespeed when prompted. 1. In the left sidebar, go to **Configure** > **Policies and settings** 2. Under **User management**, click **Service users** 3. Click **Create New Service User** 4. Under **General**, enter a **Service Name** (we suggest **Wirespeed**) and an optional description 5. Set **Expiration Date** to a value you feel comfortable with; we suggest 1 year. When the token expires you will receive an email notification from us saying the integration is experiencing errors. We also suggest setting a calendar reminder to update the token before it expires. In an upcoming release we will automatically notify you ahead of time. 6. Under **Permissions**, set the scope of access: * For MSP setups, select **Site**, choose the account from **Show Sites from Account**, then select the client site being onboarded * For single-tenant setups, choose **Account** or **Site** as appropriate for your environment 7. For each selected site or account, assign the **IR Team** role 8. Click **Create Service User**, then copy the API token and paste it into Wirespeed when prompted Use the built-in **IR Team** role for this service user. SentinelOne includes this role by default. Choose the role scope that is appropriate for your SentinelOne setup (for example, **Customer** or **Global** in the classic console, or the matching site/account scope in Singularity Operations Center). STAR designation is not exposed in Wirespeed through SentinelOne's API. On first sync, Wirespeed fetches alerts from the last **90 days**, capped at the newest **5,000** alerts. # ServiceNow Change Requests Source: https://docs.wirespeed.co/integrations/service-now Use ServiceNow change requests to automatically close endpoint detections tied to planned changes. ## What this integration does Wirespeed checks recent ServiceNow change requests during endpoint triage. When an escalating endpoint detection is tied to a managed administrator user and a matching endpoint hostname, Wirespeed can recategorize it as `ENDPOINT__PLANNED_CHANGE` and auto-close it. ## Prerequisites Before connecting ServiceNow, make sure you have: 1. A base URL that exposes the ServiceNow Table API 2. An API key that is accepted in the `apikey` request header 3. Access to the change table you want Wirespeed to query (the default is `change_request`) 4. Change requests where: * `cmdb_ci.name` matches the endpoint hostname in the detection * `assigned_to.email` matches the managed administrator user's email in Wirespeed ## Connect Wirespeed to ServiceNow 1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **ServiceNow** and click **Integrate** 3. Fill in the following fields: * **Domain** - the full base URL for your ServiceNow instance, including any required sub-path (for example `https://instance.service-now.com` or `https://api.example.com/servicenow`) * **API Key** - the key Wirespeed sends in the `apikey` header * **Table Name** - optional; defaults to `change_request` 4. Click **Save** Custom table names must use letters, numbers, and underscores only. ## How matching works * Wirespeed only performs the planned-change lookup for escalating endpoint verdicts * The detection must include at least one managed administrator user with a queryable identifier * Wirespeed queries ServiceNow using `(hostname, admin email)` pairs * It looks for recent change requests from the last 7 days * If `start_date` is empty, Wirespeed falls back to `sys_created_on` * The first matching change request is used to mark the detection as a planned change ## Troubleshooting * If validation fails, confirm the base URL includes any required sub-path and that the table name is valid * If planned changes are not being found, verify the endpoint hostname and administrator email match the values stored on the ServiceNow change request # Integration Plans & SKU Mapping Source: https://docs.wirespeed.co/integrations/sku-mappings Which integrations are included with each Wirespeed plan This page maps each integration category to its Wirespeed plan. Use it to determine which plan a customer needs based on the integrations they want to deploy. All plans include collaboration integrations (Slack, Microsoft Teams, email, ticketing) and enrichment services (IPinfo, Have I Been Pwned) at no extra cost. | Integration / Source Type | Included in Wirespeed ADR | Requires Data Plan | Examples | Partner-Ready Guidance | | - | - | - | - | - | | Identity / SSO / MFA sources | Yes | No | Microsoft 365, Google Workspace, Ping, OneLogin, Okta, Cisco Duo | Native identity integrations are included in ADR. | | Endpoint Detection & Response (EDR) | Yes | No | Microsoft Defender, CrowdStrike, SentinelOne, Palo Alto | Native EDR integrations are included in ADR. | | Remote access / VPN / ZTNA | Yes | No | VPNs and ZTNA platforms | Native remote-access integrations are included in ADR. | | Network Detection & Response (NDR) | Yes | No | Corelight, ExtraHop, Darktrace | Native NDR integrations are included in ADR. | | Secure email gateways | Yes | No | Secure email gateway integrations | Native secure email integrations are included in ADR. | | SaaS application integrations | Yes | No | HRIS, workflow tools, enterprise apps, password vaults | Native SaaS integrations are included in ADR. | | AI Security | Yes | No | Anthropic, OpenAI | Native AI platform integrations are included in ADR. | | Cloud Detection & Response (CDR) integrations | Yes | No | AWS GuardDuty, Microsoft Defender for Cloud, Google Security Command Center, Wiz / Okta CDR module | Named CDR integrations are included in ADR. | | Endpoint telemetry (raw OS / AD logs) | No | Yes | Windows Event Logs, Sysmon, on-prem Active Directory, Mac/Linux OS syslog | If the customer wants raw endpoint telemetry beyond native integrations, price the Data Plan. | | Network telemetry (raw network logs) | No | Yes | Firewalls, DNS logs, web proxy, netflow | Raw network telemetry requires the Data Plan. | | Cloud telemetry (raw cloud logs) | No | Yes | Cloud audit / trace logs, Kubernetes logs, custom | Raw cloud telemetry requires the Data Plan. | | Custom telemetry / non-native log ingestion | No | Yes | Syslog or JSON over HTTPS, additional non-native telemetry sources | If Wirespeed does not have a native integration and the customer wants log forwarding, price the Data Plan. | ## All Integrations by Category The following is the full list of integrations grouped by their type, auto-generated from the integration catalog. ### Collaboration * Connectwise PSA * Custom SMTP * DFIR IRIS * Email * Freshservice * Halo ITSM * Jira Cloud * Jira Data Center * Microsoft Teams * Microsoft Teams (Legacy) * Odoo Helpdesk * PagerDuty * ServiceNow Change Requests * Slack * SMS ### Endpoint * Acronis * Admin By Request * Agger Labs * Axonius * Crowdstrike * Fleet * Halcyon * Iru (formerly Kandji) * Jamf Pro * Jamf Protect * Microsoft * NinjaOne * Palo Alto Networks Cortex * Sandfly * SentinelOne * Sophos Central * Stairwell ### Identity * Cisco Duo * Google Alert Center * Google Workspace * Idira (formerly CyberArk) * JumpCloud * Microsoft * Microsoft Entra Sign-in Logs * Okta * OneLogin * PingOne ### Network & VPN * Cisco Secure Access * Darktrace * Netskope * Vectra ### Cloud * AWS GuardDuty * Google Security Center * Microsoft * Netskope * Orca Security * Wiz ### SIEM * Crowdstrike * Google SecOps * Microsoft * Palo Alto Networks Cortex * SentinelOne * Splunk ### SaaS * 1Password * Bitwarden * Box * GitHub * GitHub Enterprise Cloud * Wordfence ### Attack Simulation * Horizon3 NodeZero * Picus Security * SafeBreach * Tenable Nessus ### Deception * Thinkst Canary * Tracebit ### Enrichment * Have I Been Pwned * IPInfo * Reversing Labs * Wirespeed ### Email * Acronis * Check Point Harmony * FortiMail Workspace Security * Mimecast * Proofpoint * Sublime Security ### Firewalls * Barracuda CloudGen Firewall * Check Point Firewall * Cisco ASA * Cisco Meraki * FortiAnalyzer * Fortinet * Palo Alto Networks NGFW * SonicWall * Ubiquiti UniFi Network * WatchGuard Firebox ### DNS * Cisco Umbrella * Hyas Protect * Jamf Internet Security ### Custom * Cisco Catalyst * Exium * Generic JSON * Generic Syslog * ManageEngine AD Audit Plus * Microsoft Windows * Zabbix * Zscaler ZPA ### AI Security * Anthropic * OpenAI Platform # Slack Source: https://docs.wirespeed.co/integrations/slack Communicate with your users directly in Slack We use Slack's OAuth support to integrate into your Slack workspace. This integration requires `incoming webhook`, `chat:write`, and `users:read` permissions to be able to look up and interact with users in your organization. To get started, in Wirespeed go to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > Slack > Integrate. # Custom SMTP Source: https://docs.wirespeed.co/integrations/smtp Send ChatOps emails from your own domain The Custom SMTP integration allows you to send ChatOps emails through your own SMTP server. This makes emails appear from your company domain (e.g., `security@yourcompany.com`) instead of Wirespeed's default email infrastructure. When Custom SMTP is installed, it automatically replaces the default [Email](/integrations/email) integration for all ChatOps communications. ## Configuration To set up the integration, go to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Custom SMTP** and provide the following: | Field | Description | | - | - | | **SMTP Host** | Your SMTP server hostname (e.g., `smtp.office365.com`) | | **SMTP Port** | Port number. Use `587` for STARTTLS or `465` for SSL/TLS | | **Use SSL/TLS** | Optional. If not set, automatically detected based on port | | **From Email Address** | The sender email address (e.g., `security@yourcompany.com`) | | **From Name** | Display name for the sender (e.g., `Security Team`) | | **SMTP Username** | Authentication username for your SMTP server | | **SMTP Password** | Authentication password for your SMTP server | Your SMTP credentials are validated when you install or enable the integration. If validation fails, the integration will remain disabled and an error will be logged. # SonicWall Source: https://docs.wirespeed.co/integrations/sonic-wall Integrate with SonicWall ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **SonicWall** and open **Forwarder Details** 2. In [SonicOS](https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7-1-device_log/Content/Logs_Syslog/logs-syslog-adding-syslogserver.htm), go to Device > Log > Syslog > Syslog Servers and click Add 3. Enter the IP and listener port from **Forwarder Details**, set Server Type to Syslog Server, choose a Syslog Format, and click Add 4. Events will begin showing up shortly Note: Coalition's claims data shows that companies using SSL VPN solutions have a significantly higher frequency of breaches and claims. Using Wirespeed helps reduce this risk substantially, but it remains important to ensure that MFA is enforced for all users and to patch devices promptly when new security issues are reported. We strongly recommend signing up for a premium Coalition Control account so you can be kept aware of new vulnerabilities in these devices. # Sophos Central Source: https://docs.wirespeed.co/integrations/sophos Ingest Sophos Central alerts, events, and endpoints Sophos Central is currently in **beta** To integrate Sophos Central, you will need to create API credentials in the Sophos Central console and provide the resulting **Client ID** and **Client Secret** to Wirespeed. ## Prerequisites * Sophos Central admin access with the ability to manage API Credentials * An API credential with the **Service Principal Management** role. * Sophos Intercept X / Sophos Central with SIEM Integration enabled (required for alerts and events APIs) ## Create API Credentials 1. Log in to the [Sophos Central Admin console](https://central.sophos.com/) 2. Open **Settings & Policies** > **API Credentials Management** 3. Click **Add Credential** 4. Name the credential and assign the **Service Principal Management** role 5. Click **Add** 6. Copy the **Client ID** and **Client Secret** that are displayed The Client Secret is shown **only once** at credential creation time. If you lose it, regenerate the credential in Sophos Central. ## Add the Integration in Wirespeed 1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Sophos Central** 2. Paste in your **Client ID** and **Client Secret** 3. Submit the integration On connect, Wirespeed exchanges the credentials for a bearer token at `https://id.sophos.com/api/v2/oauth2/token`, then calls `https://api.central.sophos.com/whoami/v1` to discover and cache: ## What Wirespeed Ingests | Source | Sophos API | Purpose | | - | - | - | | Alerts | `GET /common/v1/alerts` | Threat detections (malware, ransomware, exploit, behavioral) | | Events | `GET /siem/v1/events` | Endpoint telemetry (IPS, AMSI, application control) | | Endpoints | `GET /endpoint/v1/endpoints` | Managed endpoint inventory for asset correlation and isolation targeting | ## Response Actions Wirespeed can isolate and unisolate Sophos-managed endpoints. # Splunk Source: https://docs.wirespeed.co/integrations/splunk Integrate with Splunk for security detection ingestion Splunk integration documentation is coming soon. You can express interest from [Integrations → View all](https://app.wirespeed.co/settings/integrations?tab=browse\&status=coming-soon). # Stairwell Source: https://docs.wirespeed.co/integrations/stairwell Ingest Stairwell detection events via JSON webhook Stairwell can send detection events to any HTTP endpoint that accepts JSON. This makes it easy to route Stairwell alerts into Wirespeed using your existing webhook-capable pipeline. When configured events fire (for example, an AV engine match or a YARA rule hit), Stairwell sends a JSON payload to the webhook URI from Wirespeed. ## Create an authentication token in Stairwell 1. Log in at [app.stairwell.com](https://app.stairwell.com) 2. Click the **Settings** icon in the left menu 3. Select **Auth tokens** under the **Organization** section 4. Click **Generate Token** and choose **API/CLI token** 5. Give the token a descriptive name (e.g., `Wirespeed`) 6. Click **Generate** and copy the token immediately — it will not be displayed again ## Find your environment ID in Stairwell 1. In **Settings**, select the **Environments** tab 2. Your environment ID is displayed on the environment detail page ## Setup in Wirespeed 1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Stairwell** 2. Read this documentation and confirm you have completed the required setup steps 3. Paste the **API token** from Stairwell into the **API Token** field 4. Paste your **Environment ID** from Stairwell into the **Environment ID** field 5. Click **Integrate** 6. Select **Webhook Details** 7. Copy the **Webhook URL** — you'll use this in Stairwell ## Configure the webhook in Stairwell 1. Login to your Stairwell environment 2. Create or update the event forwarding/webhook configuration for the detections you want to send 3. Paste the **Webhook URL** from Wirespeed as the destination endpoint 4. Save the webhook configuration and trigger a test event if available ### Optional webhook authentication To authenticate callbacks, enable **Verify Webhook Authenticity** on the Stairwell integration and copy its **Webhook Secret** from Wirespeed's Webhook Details. Prefer `Authorization: Bearer ` wherever the webhook relay can set headers. Stairwell's native webhook UI accepts a destination URI rather than custom headers. In that case append `&webhookSecret=` as a last resort. The secret then appears in the full request URI, which web servers, reverse proxies, and log collectors often record. Treat a URI-embedded secret as exposed if any intermediary logs query strings, and rotate it if that happens. If authentication is enabled, callbacks without the correct secret are rejected. ## What Gets Ingested Wirespeed ingests Stairwell detection events as JSON payloads, including webhook events such as: * **AV engine matches** * **YARA rule hits** * **Other configured Stairwell detections** The webhook expects the Stairwell trigger-match JSON shape: top-level `name`, `label`, `createTime`, `matchType`, `objectMetadata`, `objectSightings`, and `triggerCondition` (including optional YARA matches, MalEval, opinions, and threat reports). Each event is normalized into a detection record and made searchable in Wirespeed for investigation and triage. # Sublime Security Source: https://docs.wirespeed.co/integrations/sublime-security Integrate with Sublime Security for email threat detection ingestion Sublime Security integration documentation is coming soon. You can express interest from [Integrations → View all](https://app.wirespeed.co/settings/integrations?tab=browse\&status=coming-soon). # Tenable Nessus Source: https://docs.wirespeed.co/integrations/tenable-nessus Correlate detections with Tenable Vulnerability Management scan activity The Tenable Nessus integration helps Wirespeed identify detections that were likely triggered by Tenable Vulnerability Management scan activity. When Wirespeed evaluates a detection, it checks Tenable for overlapping scan runs and correlates the detection's source or affected asset with Tenable scanner and target data. This integration targets Tenable Vulnerability Management cloud APIs at `cloud.tenable.com`. Self-hosted Nessus scanner APIs are not supported yet. ## Requirements Create a Tenable API key pair with read access to scan and scanner data. The API key must be able to: * List scans * Read scan history * Read scan details * List scanners In Tenable terms, listing scanners requires the **Scan Manager** role (or **Administrator**), or a custom role with equivalent privileges. Lower roles such as Scan Operator cannot list scanners and will fail to connect. Tenable allows only one valid API key per user, and Tenable recommends a unique account for each integration. Create a dedicated service-account user for Wirespeed so its key does not collide with a person's key or another tool's. ## Setup 1. Log in to [Tenable Vulnerability Management](https://cloud.tenable.com). 2. In the upper-right corner, click your user profile icon. 3. Open **My Account**. 4. In the left navigation, click **API Keys**. 5. Click **Generate**. 6. Review Tenable's warning, then continue generating the key pair. 7. Copy the values shown under **Access Key** and **Secret Key**. Tenable only shows the secret when the key is generated, so store it somewhere secure before closing the page. 8. In Wirespeed, go to [Settings → Integrations](https://app.wirespeed.co/settings/integrations). 9. Select **Tenable Nessus**. 10. Enter the Tenable **Access Key** and **Secret Key**. 11. Save the integration. Generating a new Tenable API key pair invalidates any existing API keys for that user account. Update other tools that use the previous key before rotating it. ## How Matching Works Wirespeed checks recent Tenable scan activity around the detection timestamp. A detection is marked as correlated when Wirespeed finds an overlapping scan run and either: * The detection source IP matches a Tenable scanner IP **and** that scanner is the one that ran the overlapping scan (confirmed via the scan's reported scanner name). If the scan does not report which scanner ran it, Wirespeed falls back to target matching instead. * The affected endpoint IP or hostname appears in the overlapping scan's host or target data. # Thinkst Canary Source: https://docs.wirespeed.co/integrations/thinkst-canary Identify deception triggers in your environment 1. Login to your Thinkst Canary console 2. Click the **Settings** icon in the top right > Global Settings > API 3. Create a new Global API key with **Analyst** permissions 4. Copy the **Domain Hash** and the **API Key** 5. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) and provide the information from Step 4 Thinkst Canary alerts will now start alerting in Wirespeed. On first sync, Wirespeed fetches up to the newest **5,000** incidents. # Tracebit Source: https://docs.wirespeed.co/integrations/tracebit Import deception alerts from Tracebit Tracebit is currently in **beta**. Detections ingest normally, but are categorized as informational (non-escalating) while categorization rules are refined from production data. Auto-remediation is not performed for beta integrations. 1. Log in to your Tracebit portal. 2. Open your profile menu → **User settings** → **Manage API tokens**. 3. Click **Create new token**, add a description, choose an expiry, and enable **`alerts:all:list`** (*Allows listing alerts*). Copy the token when shown — it is only displayed once. 4. In Wirespeed, go to **Integrations → [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse)** and select **Tracebit**. 5. Confirm the **API URL** matches your Tracebit environment (`community.tracebit.com` by default; Enterprise customers should use the hostname Tracebit provided), paste your API token, and connect the integration. Tracebit deception alerts will begin syncing into Wirespeed on the next detection poll. CLI OAuth tokens (for example from `tracebit auth`) do not include `alerts:all:list` and cannot be used for this integration. Create a dedicated API token from **User settings → Manage API tokens** instead. On first sync, Wirespeed ingests up to the newest **1,000** alerts returned by the Tracebit list API. Tracebit API tokens expire (Community defaults to one year). Wirespeed warns in integration logs when a token is within 30 days of expiry — create a replacement token in Tracebit and update the integration credentials before the current token expires. # Ubiquiti UniFi Network Source: https://docs.wirespeed.co/integrations/unifi Forward UniFi Network syslog (SIEM CEF or classic gateway logging) ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Ubiquiti UniFi Network** and open **Forwarder Details** (or ask Chat for the listener `ip:port`) 2. Point UniFi logging at the Wirespeed IP and port from **Forwarder Details** using the options below 3. Events should begin appearing shortly under **Events** Navigation and field labels below match UniFi OS 5.1.x and Network 10.6.x. UniFi exposes two syslog pages that send different event classes. Sending the **same** log categories through both pages to the same Wirespeed listener produces duplicate events (especially **Updates**). You can use both pages when you need UniFi OS events **and** gateway/security logs — leave overlapping categories enabled on only one page. If duplicates appear, disable the extra syslog destination. ### Option A — Integrations: System Logging / SIEM (CEF) Use this path for UniFi OS system events in CEF format. It does not include firewall or security detections — those are on Option B. 1. In UniFi Network, open **Integrations** → **System Logging / SIEM** 2. Select **SIEM Server** 3. Choose log categories — at minimum **System** (under **UniFi OS**; also available: **Updates**, **Admins**, **Backups**, **Users**) 4. Enter the Wirespeed listener **IP Address** from **Forwarder Details** 5. Enter the Wirespeed listener **Port** 6. Click **Save** ### Option B — CyberSecure: Traffic Logging (classic gateway syslog) Use this path for gateway firewall, DHCP, and **Security Detections**. This is the path that covers firewall policy and security logs. 1. In UniFi Network, open **CyberSecure** → **Traffic Logging** 2. Under **Activity Logging (Syslog)**, select **SIEM Server** 3. Choose **Contents** categories — for example **Gateway**, **Security Detections**, **Firewall Default Policy**, **Updates**, and **Critical** 4. Leave **Debug Logs** unchecked unless you are troubleshooting 5. Enter the Wirespeed listener **Server Address** from **Forwarder Details** 6. Enter the Wirespeed listener **Port** 7. Save the configuration Wirespeed auto-detects format per event: **CEF** when the line contains `CEF:0|…`, otherwise **classic** UniFi syslog. UniFi Access and UniFi Protect are not covered by this integration. # Vectra Source: https://docs.wirespeed.co/integrations/vectra Ingest detections from Vectra 1. Login to **Vectra** 2. Navigate to **Manage** > **API Clients** 3. Select **Add API Client** 4. Provide the required information and select the **Security Analyst** role 5. Select **Generate Credentials** 6. Copy and save the **Client ID** and **Client Secret** 7. Also copy and save the domain name from the URL in your browser. E.g. `https://[account_id].cc1.portal.vectra.ai` 8. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Vectra** 9. Provide the information from the previous steps 10. Determine if Wirespeed should automatically close alerts in Vectra when closed in Wirespeed. This will affect Vectra's risk scoring. Vectra recommends only closing after you have verified a fix has been implemented. 11. Select **Add Integration** [Vectra documentation reference](https://support.vectra.ai/vectra/article/KB-VS-1835) On first sync, Wirespeed fetches up to the newest **5,000** detections. # WatchGuard Firebox Source: https://docs.wirespeed.co/integrations/watchguard-firebox Ingest logs from WatchGuard Firebox Wirespeed can ingest WatchGuard Firebox Syslog logs. Email addresses, IPs, and important dates are automatically identified and extracted. If you would like additional information extracted, use **Chat** on the left-hand navigation. ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **WatchGuard Firebox** and open **Forwarder Details** 2. Configure your Firebox to forward syslog to the IP and listener port shown there 3. Events will begin showing up shortly # Wiz Source: https://docs.wirespeed.co/integrations/wiz Ingest cloud security threat detections from Wiz Wiz uses Automation Rules to forward **Threat Detections** to Wirespeed in real-time via webhook. ## Prerequisites * A Wiz tenant with admin or project-admin permissions * Network connectivity from Wiz to `https://api.wirespeed.co` ## Setup in Wirespeed 1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Wiz** 2. Read this documentation and confirm you have completed the required setup steps 3. Click **Integrate** 4. Select **Webhook Details** 5. Copy both the **Webhook URL** and the **Webhook Secret** — you'll need both for the Wiz configuration ## Setup in Wiz Deploy the Wirespeed **integration** first, then create the automation **rule** that uses it. ### 1. Deploy the Wirespeed Integration 1. Login to your **Wiz** tenant 2. Navigate to **Settings** > **Deployments** 3. Click **Add Deployment** 4. Search for **Wirespeed** and select the Wirespeed integration 5. Complete the integration form: * **Name** — give it a descriptive name (e.g. "Wirespeed Integration") * **Scope** — choose **All Projects** unless you need project-scoped access * **URL** — paste the **Webhook URL** from Wirespeed * **Token** — paste the **Webhook Secret** from Wirespeed; Wiz sends it as `Authorization: Bearer ` 6. Click **Add Integration** ### 2. Create the Automation Rule 1. Navigate to **Automation** > **Automation Rules** 2. Click **Add Automation Rule** 3. Give the rule a descriptive name (e.g. "Forward threat detections to Wirespeed") 4. Configure **WHEN** the following trigger occurs, based on what your Wiz tenant exposes: * **If `Detection` is available**, select **Detection** > **IS** > **Created** * **If `Detection` is not available** (license- or UI-dependent), select another available trigger such as **Risk Issue** or **Cloud Event**, then add filters so the rule only fires on **Threat Detection** findings 5. Configure **IF** all of the following match: * Wiz requires at least one **IF** filter on Detection rules. Click **Add Filter**, select **Severity**, choose **equals one of**, and select **all** severity levels (Critical, High, Medium, Low, Info). Selecting every severity forwards all detections without excluding any by severity. 6. Under **THEN**, add the **Wirespeed** action from the integration you deployed above 7. Save and enable the Automation Rule Wiz applies this Automation Rule only to Detections whose Threat Detection Rule is configured to generate Threats. Detections that do not generate Threats are not forwarded. Wirespeed authenticates incoming webhooks using a Bearer token. If the **Token** is not configured on the Wirespeed integration, all webhook deliveries will be rejected with 401. ## What Gets Ingested Wirespeed receives and processes **Threat Detections** from Wiz — runtime security events triggered by Wiz Threat Detection Rules. Each detection is automatically normalized to OCSF and enriched with: * **Severity** — Critical, High, Medium, Low, or Informational * **MITRE ATT\&CK** — Tactics and techniques mapped from the detection * **Resources** — Affected cloud resources, including cloud account, region, and resource type * **Triggering Events** — The underlying cloud events (e.g. API calls) that fired the detection, including actor IP, IP reputation, and process tree where available Wirespeed processes Wiz **Threat Detections** only. Wiz Issues (misconfigurations and vulnerabilities from Controls) are not currently ingested. ## Troubleshooting Verify that your Automation Rule is enabled, includes at least one **IF** filter (for example, **Severity equals one of** with all levels selected), and is scoped to **Threat Detections** only — either via a `Detection` trigger, or via another trigger (e.g. `Risk Issue`, `Cloud Event`) with filters limiting it to Threat Detection findings. Confirm the Detection's Threat Detection Rule is configured to generate Threats. Check the rule's execution history in Wiz for errors or failed deliveries. The rule is forwarding Cloud Findings instead of Threat Detections. Delete or disable any automation rule whose trigger is Cloud Finding / vulnerability / misconfiguration, and confirm the active rule is scoped to Threat Detection as described above. Ensure the **Token** on the Wirespeed integration matches the **Webhook Secret** shown in Wirespeed under Webhook Details. Re-copying the secret and re-saving the integration is the fastest fix. Ensure your Wiz tenant can reach `https://api.wirespeed.co` on port 443. If you use IP-based firewall rules, allowlist the source IPs returned by the `dataCenterInfrastructureDetails` GraphQL query above. # Wordfence Source: https://docs.wirespeed.co/integrations/wordfence Ingest alerts from Wordfence 1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) 2. Select **Wordfence** and click **Integrate** 3. Select "Webhook Details" 4. Copy the webhook URL and secret that is displayed 5. In a new tab, login to **wordfence.com** 6. Navigate to **Account** > **Integrations** 7. Click **Add Webhook** 8. Paste the webhook URL and secret from earlier into the target URL field 9. Generate a secret and copy it 10. Click **Save** After saving, you can click **Test** in the Wordfence webhook list to send a test webhook to Wirespeed. [Wordfence documentation reference](https://www.wordfence.com/help/webhook-notifications/) # Zabbix Source: https://docs.wirespeed.co/integrations/zabbix Integrate with Zabbix for monitoring alert ingestion Zabbix integration documentation is coming soon. You can express interest from [Integrations → View all](https://app.wirespeed.co/settings/integrations?tab=browse\&status=coming-soon). # Zscaler ZPA Source: https://docs.wirespeed.co/integrations/zscaler-zpa Forward Zscaler ZPA logs to Wirespeed ## Set up 1. Follow the shared [Log Forwarders](/integrations/log-forwarders) guide to add **Zscaler ZPA** and open **Forwarder Details** 2. Login to the ZPA Admin Portal 3. Navigate to **Configuration & Control** > **Private Infrastructure** > **Log Streaming Service** > **Log Receivers** 4. Click **Add Log Receiver** and configure the **Log Receiver** tab: 1. **Name**: A descriptive name (e.g., "Wirespeed") 2. **Domain or IP Address**: Hostname or IP from **Forwarder Details** 3. **TCP Port**: Listener port from **Forwarder Details** 4. **App Connector Groups**: Select the groups whose logs you want to forward 5. Click **Next** and configure the **Log Stream** tab: 1. **Log Type**: Select the desired log type (e.g., User Activity, Browser Access) 2. **Log Template**: Select **JSON** 3. **Log Stream Content**: Use the default template 6. Click **Save** ZPA logs should reflect shortly underneath the Events page. Zscaler ZPA sends logs via App Connectors, not directly from the ZPA cloud. Ensure the selected App Connector Groups have network connectivity to the Wirespeed hostname and port. # Introduction Source: https://docs.wirespeed.co/introduction Getting started with Wirespeed ## What is Wirespeed? Wirespeed is a fully automated Managed Detection and Response (MDR) platform. We integrate with your detection platforms, user directories, mobile device managers, firewalls, and more to help protect your organization. ## How to Get Started To get started, check out our integrations on the left-hand navigation or by going to the platform and going to Integrations > Add Integrations. After you add your [user](/assets/users) directories, and [mobile device manager](/assets/endpoints) you'll see we're already going to work automatically tagging your VIP users, administrators, critical assets, and more! Go ahead and add a detection source like [Microsoft](/integrations/microsoft), [SentinelOne](/integrations/sentinel-one), or [Crowdstrike](/integrations/crowdstrike-falcon) and we'll automatically triage the last 90 days of alerts so you can compare us to your existing provider and see our automation at work. ## Got Questions? When logged into the platform you can use the **Chat** button on the left-hand navigation to talk directly to one of our engineers. You may also email [support@wirespeed.co](mailto:support@wirespeed.co) with any questions or concerns. # Endpoint Remediation Source: https://docs.wirespeed.co/remediation/endpoints Isolate servers and workstations Endpoint remediation automatically (or manually) isolates endpoints when they are associated with malicious detections. If a detection matches a verdict rule with endpoint remediation actions configured, but endpoint auto-remediation is disabled globally or blocked by group policy, the detection will be escalated to your team. Auto-remediation is not performed for detections from beta integrations. If the detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation remains available. ## Remediation Actions Wirespeed can take the following actions to remediate an endpoint: * **Isolate Endpoint** — disconnect the endpoint from the network * **Lock Device** — remotely lock the device screen Which actions appear in the UI and run for a detection depend on the connected EDR or MDM integration and the actions selected on the matching verdict rule. ## Release Actions When a detection is resolved as benign, Wirespeed can automatically reverse endpoint remediation: * **Unisolate Endpoint** — reconnect the endpoint to the network * **Unlock Device** — unlock the device screen ## Critical Assets and groups Critical Assets and other endpoint classifications are managed through [Groups](/groups/introduction). The built-in **Critical Asset**, **Domain Controller**, and **Server** groups have remediation disabled by default. Manual remediation from the case Actions menu remains available. Review how critical assets are represented in your environment before enabling remediation on those groups. ## Supported integrations Endpoint remediation and release actions are available through connected EDR and MDM integrations, including: * [Microsoft Defender for Endpoint](/integrations/microsoft) * [CrowdStrike Falcon](/integrations/crowdstrike-falcon) * [SentinelOne](/integrations/sentinel-one) * [Palo Alto Networks Cortex](/integrations/palo-alto-networks-cortex) * [Sophos](/integrations/sophos) * [JumpCloud](/integrations/jumpcloud) * [Iru](/integrations/iru) * [Jamf Pro](/integrations/jamf-pro) Each integration supports a subset of the actions above. Isolate is provided by EDR integrations; Lock Device is provided by MDM integrations such as JumpCloud, Iru, and Jamf Pro. The Remediate or Release dialog only shows actions your connected integration can perform. # File Remediation Source: https://docs.wirespeed.co/remediation/files Quarantine malicious files File remediation automatically (or manually) quarantines or deletes files when they are associated with malicious detections. If a detection matches a verdict rule with file remediation actions configured, but file auto-remediation is disabled globally, the detection will be escalated to your team. Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release. Auto-remediation is not performed for detections from beta integrations. If the detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation remains available. ## Remediation Actions Wirespeed can take the following actions to remediate a file: * **Quarantine File** — quarantine the file to prevent execution * **Delete File** — permanently delete the file from the endpoint (irreversible) Which actions appear in the UI and run for a detection depend on the connected EDR integration and the actions selected on the matching verdict rule. Delete File is irreversible. Use it only when you are certain the file should be permanently removed. ## Release Actions When a detection is resolved as benign, Wirespeed can automatically reverse file remediation: * **Unquarantine File** — release the file from quarantine Delete File has no automatic release action. ## ReversingLabs verification Automatic file remediation and release require [ReversingLabs](/integrations/reversing-labs) enrichment to confirm file risk: * **Auto-remediation** requires ReversingLabs to classify the file as malware or a late stage tool * **Auto-release** requires a prior successful Wirespeed remediation and ReversingLabs to classify the file as benign Manual remediation from the case Actions menu is still available when enrichment is pending. ## Supported integrations File remediation and release actions are available through connected EDR integrations, including: * [Microsoft Defender for Endpoint](/integrations/microsoft) * [CrowdStrike Falcon](/integrations/crowdstrike-falcon) * [SentinelOne](/integrations/sentinel-one) * [Palo Alto Networks Cortex](/integrations/palo-alto-networks-cortex) * [Halcyon](/integrations/halcyon) Each integration supports a subset of the actions above. For example, CrowdStrike supports delete and unquarantine; SentinelOne, Palo Alto Cortex, and Halcyon support quarantine and unquarantine; Microsoft supports quarantine. The Remediate or Release dialog only shows actions your connected integration can perform. # Introduction to Remediation Source: https://docs.wirespeed.co/remediation/introduction Automatic and manual isolation of compromised assets Remediation allows Wirespeed to isolate Endpoints, Users, and Files when they are associated with malicious detections. Automatic remediation is disabled by default and you should make sure to review case logs with test mode enabled before turning this setting on. During that review ensure your sampling of cases was handled correctly, any remediations appeared correct, and reach out to the Wirespeed team if you see any irregularities. When you are ready to enable automatic remediation, you can modify the settings underneath Settings > Remediation. Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release. ## Settings > Remediation The Remediation page under Settings has three tabs: * **Actions Taken** — shows which remediation actions were taken on your behalf by Wirespeed. * **Actions Blocked** — shows automatic remediations that did not run because of a team toggle, group policy, test mode, daily limit, or a similar control. * **Configuration** — configure automatic remediation and related settings, including identity, endpoint, and file auto-remediation toggles and the daily remediation limit. Service provider teams see **Actions Taken** and **Actions Blocked** across managed clients. The **Configuration** tab is available on individual tenant teams only. Auto-remediation is not performed for detections from beta integrations. If a detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation is still available for these detections. ## Supported actions Wirespeed supports the following remediation and release actions. Which actions are available for a given asset depends on your connected integrations and the actions configured on the matching [verdict rule](/verdicts/introduction#remediation). | Asset type | Remediation actions | Release actions | | - | - | - | | **User** | Disable Account, Require MFA Re-enrollment, Reset Password, Revoke Sessions | Enable Account | | **Endpoint** | Isolate Endpoint, Lock Device | Unisolate Endpoint, Unlock Device | | **File** | Quarantine File, Delete File | Unquarantine File | See [User Remediation](/remediation/users), [Endpoint Remediation](/remediation/endpoints), and [File Remediation](/remediation/files) for details on each asset type. Verdict rules control which specific actions run for a detection. Global remediation settings under Settings > Remediation must also be enabled for automatic remediation to proceed; otherwise the detection is escalated. [Groups](/groups/introduction) can disable remediation for specific assets even when global settings are on. ## Max Auto Remediations Per Day This setting allows you to configure the maximum number of auto remediations that can be performed per day. This is useful if you want to limit the number of auto remediations that can be performed to avoid excessive use of the feature. Once this limit is reached, auto remediations will be stopped for the remainder of the day and cases will be escalated to your team instead. If a case contains more than 10 users or endpoints, remediation will be skipped and the case will be escalated to your team instead. # User Remediation Source: https://docs.wirespeed.co/remediation/users Automatically remediate compromised users User remediation automatically (or manually) isolates users when they are associated with malicious detections. If a detection matches a verdict rule with user remediation actions configured, but identity auto-remediation is disabled globally or blocked by group policy, the detection will be escalated to your team. Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release. Auto-remediation is not performed for detections from beta integrations. If the detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation remains available. ## Remediation Actions Wirespeed can take the following actions to remediate a user: * **Disable Account** — prevent the user from signing in * **Require MFA Re-enrollment** — remove registered MFA methods so the user must enroll again at the next sign-in that requires strong authentication * **Reset Password** — force a password change on next sign-in * **Revoke Sessions** — terminate all active sign-in sessions For Microsoft Entra accounts synced from on-premises Active Directory, Wirespeed cannot reset the password through Microsoft Graph and skips that action. Microsoft Graph can report a successful account disable, but a later directory sync can re-enable the account because on-premises Active Directory remains authoritative. Wirespeed continues other configured remediation such as revoking sessions. During automatic remediation, the skipped password reset escalates the detection for analyst follow-up. Reset the password and disable the account in on-premises Active Directory to make those actions durable. Which actions appear in the UI and run for a detection depend on the connected identity provider and the actions selected on the matching verdict rule. ## Release Actions When a detection is resolved as benign, Wirespeed can automatically reverse user remediation: * **Enable Account** — re-enable the user account for sign-in Require MFA Re-enrollment, Reset Password, and Revoke Sessions are one-shot actions and do not require a separate release step. Require MFA Re-enrollment is destructive: removed authentication methods cannot be restored by Wirespeed, and the user must register new methods before satisfying an MFA challenge. ## VIPs and NHIs VIP and NHI users are managed through [Groups](/groups/introduction). The built-in **VIP** and **NHI** groups have remediation disabled by default, so those identities are not automatically remediated even when identity auto-remediation is enabled globally. Manual remediation from the case Actions menu remains available. Review how VIPs and NHIs are represented in your environment before enabling remediation on those groups. ## Supported integrations User remediation and release actions are available through connected identity providers, including: * [Microsoft](/integrations/microsoft) * [Okta](/integrations/okta) * [Google Workspace](/integrations/google-workspace) * [JumpCloud](/integrations/jumpcloud) * [OneLogin](/integrations/onelogin) * [Cisco Duo](/integrations/cisco-duo) * [CyberArk](/integrations/cyberark) (Beta) Each integration supports a subset of the actions above. The Remediate or Release dialog only shows actions your connected integration can perform. # Service Providers Source: https://docs.wirespeed.co/service-provider Your guide to managing your clients on Wirespeed ## What is a Service Provider? A company operating as a Managed Security Services Provider (MSSP) or more generally as a Managed Services Provider (MSP) has many clients that they need to support on the Wirespeed platform and their needs differ from a single direct customer. In the Wirespeed platform, a Service Provider is a special kind of tenant that has the ability to manage other client tenants. Service Provider tenants cannot have their own integrations, though, so remember to create a client tenant for your own corporate entity, so any alert integrations can be handled there. ## Adding a Client Adding a client is easy. Click on Clients in the navigation menu and then the "add new client" button. This will spin up an empty client tenant under your management. You can optionally choose to invite team members from your client's organization to have access. The **Clients** table includes **Billable Users** and **Billable Endpoints** columns per client. See [Billable Assets](/assets/billable-assets) for how those counts are calculated. ## Demo Clients When you add a client, you can choose to enable the client as a demo client, which will populate it with sanitized data, so you can experiment, play, or even show your own clients without exposing any real or sensitive client data. Client demo tenants are free. ## Managing a Client Each client tenant has individual settings that can be managed separately by clicking into the tenant, then clicking on settings in the navigation menu. For **New Case Escalation**, **New System Security Event**, and **New Critical Defect**, notification subscription changes in your Service Provider tenant are synced to all managed clients. **Activity Summary** notifications are managed per-tenant and are not globally synced in the same way. Team inbox escalation emails on child tenants include: * inboxes configured on the child tenant * plus Service Provider tenant inboxes (when configured) This allows central coverage from the parent team while still supporting client-specific escalation destinations. ## Deleting a Client To delete a client, switch to their view, navigate to Team and select "Delete Team". This action is irreversible. ## Operating Teams An operating team is a special client tenant that represents your internal service provider team. Since service providers frequently access and manage their customers' environments, marking a client as an operating team helps Wirespeed better understand your workflow. When Wirespeed detects activity from your operating team (like logins or administrative actions) in your clients' environments, it will automatically recognize this as legitimate service provider activity rather than potentially suspicious behavior. For example, if one of your technicians logs into a client's environment from a managed device in your operating team, Wirespeed will recognize this as authorized access rather than triggering unnecessary alerts. You can mark your operating teams by going to the Clients page and selecting the row action 3-dot button and clicking "Select as Operating Team". ## Customer Settings Fine tune how Wirespeed is presented to your clients. ### Support Email When set this will be the `reply-to` address for all email notifications and will be the email used when customers select "Email Support" in the platform. ### Platform Name This will be shown in place of "Wirespeed" in various places around the UI and in email notifications. Wirespeed's name may still show up in places like the domain name, chat ops, login pages, etc... ### Platform Logo The Wirespeed logo on the top right of the app can be replaced with your own logo to give the application an MSP-branded experience for your clients. Click Teams in the navigation menu and you will find the option to upload a logo. For best results, upload both Light and Dark Mode logos to ensure your branding looks great in all themes. Logo Requirements: * Format: PNG * Background: Transparent * Aspect Ratio: Square (1:1) or Horizontal Rectangle (4:1) * File Size: Max 1MB ### Corporate Address Used in the footer of email notifications. ### Email Signature Used as a salutation at the end of every email notification. # Notifications Source: https://docs.wirespeed.co/settings/notifications Understanding notification types and managing your notification preferences Personal notification preferences can be found under **Settings > Your Profile**. Team Account Notification preferences (shared inbox recipients) can be found under **Settings > Team Notifications**. ## Overview Wirespeed sends email notifications to keep you informed about important activity in your account. Settings on this page fall into two areas: * **Personal Notifications** — which notification types you personally receive, and how often. * **Team Account Notifications** — shared inbox recipients for team-wide delivery of any notification type. By default, new users are subscribed to the standard notification types when their account is created. You can adjust personal preferences at any time on the **Your Profile** tab. ## Personal Notifications The **Personal Notifications** card lists each notification type with a toggle and, where supported, a frequency dropdown. * Use the **toggle** to subscribe or unsubscribe from a type. * When subscribed, use the **frequency dropdown** to choose Real Time, Daily, or Weekly (where available). As a service provider user, your subscriptions will automatically watch all of your client accounts. ## Notification Types ### New Case Escalation A notification sent when a new case has been escalated in response to a detection. Case escalations are the primary way Wirespeed alerts you to security incidents that require your attention. * **Default frequency:** Real Time * **Available frequencies:** Real Time, Daily, Weekly This is typically the most important notification to keep enabled. Escalated cases represent detections that Wirespeed has determined require human review or action. ### New System Security Event A notification sent when a security-relevant event occurs within your Wirespeed account. These are **platform audit log events** — not detection alerts from your integrated security tools. System security events help you monitor administrative and security-sensitive changes made to your Wirespeed account. Events that trigger this notification include: * **User management** — locking or unlocking a user account, deleting a user, changing a user's role, unsubscribing a user from notifications * **Credential changes** — resetting a team member's password, resetting multifactor authentication (MFA) credentials * **Team administration** — adding an operating team, resetting credentials for a user You can review all system security events by selecting your email in the bottom left corner of the screen, and selecting "System Log". * **Default frequency:** Real Time * **Available frequencies:** Real Time, Daily, Weekly ### New Critical Defect A notification sent when a critical defect has been identified in your cases. Critical defects are issues found by Wirespeed's automated quality assurance checks that may affect the accuracy or completeness of your case analysis. * **Frequency:** Real Time (cannot be changed) ### Integration Health A notification sent when one of your integrations becomes unhealthy or unstable, or when a previously unhealthy integration recovers. * **Frequency:** Real Time (cannot be changed) ### Activity Summary A recurring summary of activity in your account, including automatically closed cases, permission updates, and other routine events. This provides a periodic digest so you can stay informed without receiving individual notifications for each event. * **Default frequency:** Daily * **Available frequencies:** Daily, Weekly ## Notification Frequency Depending on the notification type, you can choose how often you receive notifications: | Frequency | Description | | - | - | | **Real Time** | Sent as soon as the event occurs (with a short delay for batching). | | **Daily** | Aggregated and sent once per day. | | **Weekly** | Aggregated and sent once per week. | Some notification types have a fixed frequency. For example, **New Critical Defect** and **Integration Health** notifications are always sent in real time and cannot be changed to a daily or weekly cadence. ## Team Account Notifications The **Team Account Notifications** card lets you route any notification type to one or more shared inboxes — ticketing systems, listservs, or other team email addresses. Each notification type has its own set of recipients, subject line, and formatting options. ### Configuring a notification type 1. Navigate to **Settings > Notifications**. 2. Find the notification type you want to configure in the **Team Account Notifications** card. 3. Click the **gear icon** (⚙) to open the configure dialog. 4. Add one or more recipient email addresses. Up to ten addresses are supported per notification type. 5. Optionally customize the **subject line** and toggle **Rich HTML emails** on or off. 6. Click **Save**. Delivery is enabled automatically when at least one recipient is saved. ### Enabling and disabling delivery Use the **toggle** on each notification type row to enable or disable delivery to all configured inboxes at once. * If no recipients have been configured yet, turning the toggle on will open the configure dialog automatically. * Turning the toggle off suspends delivery without removing your recipient list. ### Subject Line You can provide a custom subject line for each notification type. Dynamically include case and detection values by typing a backtick `` ` `` and selecting the variable you want from the autocomplete list. For service provider teams, default subject lines end with "for `teamName`" so recipients can immediately identify which client account the notification is about. ### Rich HTML Emails By default, notifications are sent as rich HTML emails. Disable this option for notification types going to ticketing systems or inboxes that display raw HTML as noise — plain-text emails integrate more cleanly with those tools. ### Service provider behavior If you are an SP user viewing a client team, the Team Account Notifications card shows that client team's own inbox configuration, which you can manage on their behalf. Any changes you make will be reflected in the client team's inbox configuration. To customize the shared behavior of all your client teams, switch back to your service provider team. Here, you can customize the email branding for all notification emails sent to your client teams: | Setting | Description | | - | - | | **Support Email** | Used as the reply-to address in outbound emails and for the Chat button in-platform. | | **Corporate Address** | Appears in email footers. | | **Email Signature** | Appended to email footers. | # Team Roles & Permissions Source: https://docs.wirespeed.co/settings/roles Understanding team member roles and access levels Wirespeed uses role-based access control to manage what team members can see and do. There are three roles: **Viewer**, **Analyst**, and **Admin**. Read-only access Respond to security events Full platform control *** ## Viewer Read-only access to security data. Best for stakeholders and observers. **Can**: * View detections and cases * View assets (users, endpoints, files, IPs) * View integrations * View team settings * Search the data lake (events) **Cannot**: * Update cases or detections * Create custom detections * Take remediation actions * Configure integrations * Manage team members *** ## Analyst View and respond to security events. Best for SOC analysts and security engineers. **Everything Viewers can do, plus**: * Update cases and detections * Add case notes and attachments * Create custom detections * Take remediation actions (remediate/release users and endpoints) * Test chat-ops * Manage integration configuration (for select integrations, once added by an Admin) **Cannot**: * Add or remove integrations * Manage team members * Manage remediation policies * Manage exclusions * Manage asset automations * Manage verdicts * Run integration actions *** ## Admin Full platform control. Best for security team leads and platform administrators. **Everything Analysts can do, plus**: * Configure integrations (add, update, delete) * Manage team members (invite, remove, change roles) * Manage remediation policies * Manage exclusions * Manage asset automations * Manage verdicts * Manage chat-ops * Run integration actions * Update team settings and billing Only grant Admin access to trusted team leads who need to configure integrations and manage team settings. *** ## Managing Roles ### Changing a Team Member's Role 1. Navigate to **Settings** > **Team** 2. Find the team member in the **Team Members** table 3. Click the **three-dot menu** and select **Change Role** 4. Choose Viewer, Analyst, or Admin Only Admins can change team member roles. *** ## Role Comparison | Permission | Viewer | Analyst | Admin | | - | :-: | :-: | :-: | | **View detections & cases** | ✓ | ✓ | ✓ | | **View assets** | ✓ | ✓ | ✓ | | **View integrations** | ✓ | ✓ | ✓ | | **View team settings** | ✓ | ✓ | ✓ | | **Search the data lake** | ✓ | ✓ | ✓ | | **Update cases & detections** | | ✓ | ✓ | | **Add case notes** | | ✓ | ✓ | | **Create custom detections** | | ✓ | ✓ | | **Take remediation actions** | | ✓ | ✓ | | **Test chat-ops** | | ✓ | ✓ | | **Manage integration configuration** | | ✓ | ✓ | | **Add/remove integrations** | | | ✓ | | **Manage team members** | | | ✓ | | **Manage remediation policies** | | | ✓ | | **Manage exclusions** | | | ✓ | | **Manage asset automations** | | | ✓ | | **Manage verdicts** | | | ✓ | | **Manage chat-ops** | | | ✓ | | **Run integration actions** | | | ✓ | *** ## Team API Keys Team API keys can be created with any role (Viewer, Analyst, or Admin) and have the same permissions as a team member with that role. To create a team API key: 1. Navigate to **Settings** > **Team** 2. Scroll to **Team API Keys** 3. Provide a **name**, **role**, and **expiration** (1-720 days) 4. Copy and securely store the token (it will only be displayed once) *** ## FAQ Yes. If you're part of multiple teams, you can have different roles on each team. No. Integration credentials and API keys are never displayed to any role, including Admins. You can only add or update them, not view existing values. You cannot remove the last Admin from a team. Wirespeed requires at least one Admin per team to ensure the team can be managed. # Team Source: https://docs.wirespeed.co/settings/team Managing your team and users Team settings can be found under **Settings > Team**. Use the **Team** tab to change your team name and platform branding. Use **Team Members** to manage users. Personal notification preferences are on the **Your Profile** tab. Team Account Notifications (shared inbox, subject line, and rich case formatting) are in the **Team** tab. See [Notifications](/settings/notifications). ## Billable resources The **Billable Resources** section on **Settings > Team Analytics** shows current billable user and endpoint counts for your team. See [Billable Assets](/assets/billable-assets) for how counts are calculated. ## Test Mode Test mode is enabled by default for all new accounts. This mode blocks **automated** outbound actions from Wirespeed—such as automatic remediation, verdict sync to your integrations, and ChatOps—so you don't interact with your end users and external systems until you are ready. **Manual** actions, such as remediation you initiate from a case, are not blocked. Team members that are signed up to Wirespeed will still receive notifications as necessary. You can enable/disable test mode underneath your Team page. ## Team API Keys Team API keys allow you to programmatically access the Wirespeed API using a service account. These keys are associated with your team rather than individual users, making them ideal for automation and long-term access. 1. Sign in as a team **Admin** (only Admins can access Team API Keys). 2. In Wirespeed, open **Settings → Team**. 3. Scroll to **Team API Keys**. 4. Create a key with a name, [role](/settings/roles), and expiration (1–720 days). 5. Copy the token immediately — it is shown **only once**. Keys are prefixed with `wspd-`. ## Security ### (Un)lock Users You can lock and unlock users by highlighting their row in the "Team Members" table, selecting the 3-dot button on the right-hand side, and choosing the appropriate action. ### Reset team member MFA/password If a team member forgets their password they can reset it on the login page or by having you select the "Reset credentials" options underneath the 3-dot menu on the Team Members table. If a team member loses access to their MFA device, the only way to reset it is by you selecting "Reset credentials" for their account. They will receive an invite in their email to re-register for the platform. ### Audit Log You can view the audit log for your team by selecting your email in the bottom left corner of the screen, and selecting "System Log". ## Demo Team A demo team contains sample data and integrations for you to explore the functionality of Wirespeed. Demo teams are primarily read-only, if you would like to try some of your integrations, request a new tenant to try out. # Introduction to Verdicts Source: https://docs.wirespeed.co/verdicts/introduction Customize how Wirespeed automatically handles your detections After Wirespeed receives a detection from one of your integrations, it is categorized and goes through the process of **verdicting**. Verdicts are a series of enrichments and checks we perform on detections and related data in your environment to determine what actions should be performed. Below are a few examples from the Endpoint > Execution detection verdicts: Verdicts Each rule shows when it runs (for example **Immediate**), the condition that must be true (**if**), and the actions Wirespeed takes (**then**). When remediation actions are enabled, the outcome lists the specific actions in parentheses — for example, **Remediate Endpoint (Isolate Endpoint, Lock Device)**. The verdicts are processed in a top down order. If the first verdict is not true, it continues until a true verdict is reached or we hit the default verdict. You can customize these verdicts to tune Wirespeed to your environment. ## Customizing Verdicts When editing a verdict rule, you can configure remediation actions, response options, verdict, and severity. ### Remediation Remediation actions automatically remediate or release users, endpoints, and files associated with a detection. For each asset type, you can choose which specific actions to perform. #### Remediate User Lock down users associated with this detection. Available actions: * **Disable Account** — prevent the user from signing in * **Require MFA Re-enrollment** — remove registered MFA methods and require enrollment again (destructive and one-shot) * **Reset Password** — force a password change on next sign-in * **Revoke Sessions** — terminate all active sign-in sessions #### Remediate Endpoint Isolate endpoints associated with this detection. Available actions: * **Isolate Endpoint** — disconnect the endpoint from the network * **Lock Device** — remotely lock the device screen #### Remediate File Quarantine or delete files associated with this detection. Available actions: * **Quarantine File** — quarantine the file to prevent execution * **Delete File** — permanently delete the file from the endpoint (irreversible) #### Release User Reverse user remediation when a detection is resolved as benign: * **Enable Account** — re-enable the user account for sign-in #### Release Endpoint Reverse endpoint remediation when a detection is resolved as benign: * **Unisolate Endpoint** — reconnect the endpoint to the network * **Unlock Device** — unlock the device screen #### Release File Reverse file remediation when a detection is resolved as benign: * **Unquarantine File** — release the file from quarantine If a detection matches a verdict rule with remediation actions configured, but the corresponding global auto-remediation setting is disabled, the detection will be escalated to your team. See [User Remediation](/remediation/users), [Endpoint Remediation](/remediation/endpoints), and [File Remediation](/remediation/files) for details. ### Response #### Escalate Notify your team about the detection for manual investigation. #### Run Monitors Use case monitors to watch for further activity related to this detection. #### Correlate & Resolve Resolve the detection and allow it to be used as a threat indicator for other cases. #### Skip Ignore this verdict and continue on. You cannot skip the default rule. #### Chat Ops Reach out to the user(s) affected by this detection and ask them if it was an intentional action. Additional options are available: * **Chat Ops MFA** — require SMS MFA when a user claims they performed the activity (requires Chat Ops Second Factor in team settings) * **VIP Chat Ops** — allow Chat Ops for VIP users on this rule **Timeout** — when a user does not respond within the chat ops timeout window defined in your team settings, choose whether to continue with a verdict, resolve with a verdict, or run monitors. **Unsure Verdict** — when a user responds that they are unsure if they performed the action, continue with the selected verdict. Malicious will result in the user and endpoint being remediated, benign will resolve the case, and suspicious will escalate. ## Case monitors and productivity logs Case monitors run for some categories (for example Identity Login) and watch for patterns over time using platform data, not only the original detection. The Identity Login monitor depends on productivity logs: mailbox and related collaboration activity that Wirespeed stores as productivity-tagged events. Before running its rules, the monitor checks that your tenant has enough recent volume (at least 250 productivity-tagged events in the last 30 days). If that threshold is not met, the monitor skips so it does not draw conclusions without enough data. That is not a signal that a specific integration is broken; it means productivity log volume in Wirespeed is too low for this monitor to run meaningfully. ### Which integrations supply productivity logs? Productivity-tagged events come from: | Integration | Role | | - | - | | [Microsoft](/integrations/microsoft) (Microsoft 365) | Unified Audit Log (UAL) activity that Wirespeed maps to productivity actions (for example mailbox rules, mail access/send/delete, SharePoint/OneDrive file activity, and certain account-related operations). | | [Google Workspace](/integrations/google-workspace) | Gmail audit/reporting (message sent and received). | Other integrations do not currently feed this productivity stream. If you rely only on vendors outside that table, you may see the skip message until Microsoft 365 and/or Google Workspace mail and audit data is connected and ingested at sufficient volume.