Sekoia.io Sekoia.io

Integrate your Sekoia.io SIEM alerts, threat intelligence and assets

The Sekoia.io connector allows you to integrate your SIEM data, security alerts, and threat intelligence information into OverView.

Overview

The Sekoia.io connector enables you to collect the following information:

  • SIEM alerts and incidents
  • Threat intelligence
  • Monitored assets

Prerequisites

  • Access to a Sekoia.io instance
  • Sekoia.io API token generated
  • API permissions configured

Information to provide in OverView

FieldDescription
API KeySekoia.io API key
API URLSekoia.io API URL (e.g., https://api.sekoia.io)

Parameters

These parameters are optional. Leave them at their default value unless you have a specific reason to change them.

ParameterDescriptionDefault
Include Assets Without EventsInclude assets that have never been seen in any eventDisabled

Configuration

Generate a Sekoia.io API Key

  1. Log in to your Sekoia.io account with an administrator-level role (only admin role users can create API keys).
  2. Navigate to Settings > Workspace > API Keys.
  3. Click Create or Add to create a new API key.
  4. Fill in the required information:
    • Name: Descriptive name (e.g., "OverView Connector").
    • Description: At least 10 characters (e.g., "OverView vulnerability monitoring integration").
    • Expiration Date: Set an appropriate expiration period.
  5. Assign permissions based on your use case:
    • Read access to SIEM events and alerts
    • Read access to threat intelligence
    • Read access to asset inventory
  6. Click Generate and note the API key immediately (it will only be displayed once).

Configure the connector in OverView

  1. In OverView, go to Data Sources Settings > Sources.
  2. Select Sekoia.io and click Configure.
  3. Fill in the required fields:
  4. Click Save Configuration.
Alternative: file import through DropPoint

The API access described above is the recommended method for this connector. Where it is not available (a segregated network, a version or licence without API, an export you already produce), OverView accepts file exports, to be uploaded to the bucket dedicated to Sekoia.io.

Where do the files go?

Bucket : s3://sekoia/

Example : s3://sekoia/export.csv

The procedure is described in the OverView DropPoint guide: generating credentials, configuring the client, then sending files from the OverView web interface, the AWS CLI or an SDK. Its examples come pre-filled with this bucket when you follow this link.

Official Documentation

For additional information, refer to the Sekoia.io Manage API Keys documentation.

Required Permissions

The API key must have the following minimum permissions:

  • Read access to SIEM events
  • Access to security alerts
  • Access to threat intelligence
  • Access to asset inventory
← PreviousNinjaOneNext →Cyberwatch