Cynet

Cynet helps organizations to detect, prevent, and respond to threats. Cynet's platform protects endpoints, users, networks, and SaaS applications. It can automatically investigate threats and remediate attacks. For detailed information, please refer to the Cynet’s official documentation.

Integration Method: API

Tables: Detection Finding (2004)

This integration supports the following events.

This integration supports the following versions.

Prerequisites

• The user should have access to the Cynet platform.

• The user should have access to DataBee console.

Configuration Overview

1. Create Role and assigned to the User to generate a Access Key and Secret Key from Cynet platform to access the APIs of Cynet platform.

2. Add Cynet data feed in the DataBee console with the below parameters.

   DataBee Parameter	Cynet Parameter
   API Base URL (<instance>)	Instance
   Token URL (<instance>)	Instance
   API Key	Access Key
   Secret Key	Secret Key
   Key Id	Client ID

Cynet Configuration

Create Role

1. Sign in to the Cynet platform. Copy the instance name for later use.
    

2. Navigate to Settings.
    

3. Expand Settings and navigate to User and Roles.
    

4. Navigate to Roles, then click on Add Role.
    

5. Add ‘Role name’ and select the permission as API. After that click on Add.
    

Create User

1. Log in to the Cynet application and navigate to Settings.
    

2. Expand Settings and navigate to User and Roles. 
    

3. Inside the Users and Role, click on API Users.
    

4. Click on New.
    

5. Enter the ‘Display name’, assign the ‘User Role’ created in the previous step and then click on Add.
    

6. Copy the generated Access Key and Secret Key for later use to configure the DataBee UI. Then click on Close.
    

   Note:

   Store the generated credentials in secure place, as it will only be visible once.

Obtain Client Id

1. If you are a single tenant: Contact Cynet to receive your client ID.

2. If you are an MSSP: In the Cynet 360 console, navigate to Global Settings > Client Site Manager > Sites Status. Your sites are listed on this page with the client IDs.

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for the Cynet and click it as shown below.
    

3. Click on the API Ingest option for collection method.
    

4. Enter feed contact information and click Next.
    

5. In the configuration page, confirm the following:

   • Authorization Method: Token URL Authentication

   • API Base URL: this is the base URL that DataBee will interact with. Replace <instance> with your instance domain value.

   • Token URL: this is the Authentication URL that DataBee will interact with to get access token. Replace <instance> with your instance domain value.

   • API Key: enter the above generated Access Key.

   • Secret Key: enter the above generated Secret Key.

   • Key Id: enter the Client ID.

   • Event Types: preselected for all the event types that integration pulls.
      

6. Click Submit.
   

Troubleshooting Tips

• Ensure Access Key, Secret Key and Client ID pasted correctly. If credentials are lost, then try to regenerate the credentials by creating User and assign the specified Role. Ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.

• Ensure API permission is provided as permission while generating Role.