ReliaQuest GreyMatter security operations platform provides unified visibility, automation, and response capabilities across an organization's security infrastructure. For more information refer to the ReliaQuest GreyMatter documentation.
Integration Method: API
Tables: Incident Finding (2005), Device Inventory Info (5001), Detection Finding (2004)
This integration supports the following events.
Event | Description |
|---|---|
Incidents | Retrieve incident records including security alerts, investigations, and incident lifecycle information. |
Assets | Retrieve asset inventory information including devices, IP addresses, operating systems, and security tool visibility. |
Detections | Retrieve detection rules and customer-specific detections with MITRE ATT&CK mapping. |
Prerequisites
The user should have access to ReliaQuest GreyMatter platform with API access privileges.
The user should be able to generate an API key with appropriate permissions.
The user should have access to the DataBee console.
Configuration Overview
Generate an API key in ReliaQuest GreyMatter.
Add the ReliaQuest GreyMatter data feed in the DataBee console with the below parameters:
DataBee Parameter
GreyMatter Parameter
API Key
x-api-key (API Key from GreyMatter)
Asset Types
Comma-separated asset type IDs (default: 1)
ReliaQuest GreyMatter Configuration
Genarating API Key
Navigate to GreyMatter > Settings > API Key Management.
Click the New API Key button in the top right corner.
Select an Expiration Date (default is 1 year) and then click the Create Key button.
The generated Key will be displayed. Copy the key for later use.
Note:
This key only appears once, so be sure to copy it carefully and keep it safe.
After closing the prompt, you will be redirected to the API Key Management screen, which shows the key expiration date, creation date, last query, and last usage time.
Refer to https://apidocs.myreliaquest.com/ for additional information.
DataBee Configuration
Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
Search for the ReliaQuest GreyMatter and click it as shown below.
Click on the API Ingest option for the collection method.
Enter feed contact information, keep Entity Resolution checkbox checked if you want it else uncheck it and scroll down.
In the configuration section, confirm the following:
Token: Paste the X-API-KEY generated earlier.
Event Types: Preselected for all the event types that integration pulls.
Asset Type IDs: Enter the comma-separated asset type IDs to filter.
Click on the Submit button.
Troubleshooting Tips
Ensure the API Key is pasted correctly and not expired. Since the API Key cannot be viewed after it is created, re-create the API Key if needed, paste it into a text editor to verify there are no extra spaces or unexpected characters, and then reconfigure the DataBee feed.
If assets are not retrieved, then check the Asset Types configuration and ensure valid asset type IDs are specified. The default asset type is 1; add additional types if required (for example, 1,2,3).