WithSecure Elements

The WithSecure Elements connector allows you to centralize your protected endpoints inventory and threat detections identified by your WithSecure platform.

Objective

The WithSecure Elements connector retrieves the following information:

• Protected endpoints inventory
• Threat detections and alerts
• Endpoints protection status

Prerequisites

• Access to WithSecure Elements with API rights
• Generation of API authentication credentials (Client ID, Client Secret)

Information to provide in OverSOC

*Required fields

Procedure

Generate API credentials

1. Log in to the WithSecure Elements console.
2. Go to Management > Organization Settings > API client.
3. Click Create API client.
4. Name the client OverSOC with appropriate description.
5. Select the scope:
   • Read-only: Check to enable read-only access (recommended for monitoring)
6. Click Create.
7. Copy the Client ID and Client Secret (secret will only be displayed once).

Configure the connector in OverSOC

1. In OverSOC, go to Data Sources Settings > Sources.
2. Select WithSecure Elements and click Configure.
3. Fill in the required fields:
   • API URL: https://api.connect.withsecure.com
   • Client ID: Generated Client ID
   • Client Secret: Generated Client Secret
4. Click Test Connection to verify authentication.
5. Click Save Configuration.

View WithSecure Elements documentation

Required Permissions

The API client must use the scope-based permission model:

• connect.api.read: Read-only access to API (enables endpoints, detections, and protection status access)