XM Cyber
Connect OverView to XM Cyber to retrieve your devices, Active Directory and Azure identities, installed software and CVEs from the Vulnerability Risk Management module
The XM Cyber connector allows OverView to retrieve your devices, identities, installed software and vulnerabilities directly from your XM Cyber tenant for a consolidated view of your exposure.
Objective
The XM Cyber connector retrieves the following information:
- Devices — machines covered by a sensor, agentless machines, and Active Directory computers, with their hostname, FQDN, IP and MAC addresses, hardware, operating system, sensor version and site
- Identities — Active Directory users, Azure users and Azure service principals, with their privilege flags, MFA status and password policy attributes
- Installed software and its CVEs, from the Vulnerability Risk Management (VRM) module, with CVSS, EPSS and KEV severity data
- Optionally, hosts seen by the Passive Discovery Scan — the machines no sensor covers, with their MAC address and listening ports
Prerequisites
- Access to the XM Cyber console with the rights to create API keys under System Config
- The Vulnerability Risk Management (VRM) module enabled on your tenant, for installed software and CVEs
- The Passive Discovery Scan module enabled on your tenant, if you want the unmanaged hosts it discovers
Information to provide to OverView
Contact OverSOC support to configure this connector. You will need to provide:
| Field | Description |
|---|---|
| Tenant | Your tenant name alone, e.g. acme — not a URL. The console URL https://acme.clients.xmcyber.com is built from it |
| API Key | The API key created in the procedure below |
| Domain | Only if your deployment does not sit on the public SaaS domain. Defaults to clients.xmcyber.com |
The following options can also be set, and can be left at their default values:
| Option | Default | Description |
|---|---|---|
| Include identities | Enabled | Retrieve Active Directory and Azure accounts |
| Include VRM | Enabled | Retrieve installed software and CVEs from the VRM module |
| Include Passive Discovery Scan | Disabled | Retrieve the hosts seen on the network without a sensor. It imports every host observed on the wire, which can grow your estate substantially |
Required Permissions
The connector is strictly read-only. The API key needs read access to:
- the entity inventory — devices and identities
- the Vulnerability Risk Management (VRM) module — installed software and CVEs
- the Passive Discovery Scan, only if you enable that option
Setting every permission to Read when creating the key, as described below, covers all of them. Never grant write permissions.
Procedure
Create an API key in XM Cyber
- Sign in to your XM Cyber console at
https://<tenant>.clients.xmcyber.com. - Navigate to System Config > Integrations.
- Under XM Cyber API keys, click View / generate API keys.
- Click Create New API Key.
- Fill in the key details:
- Application name — e.g. "OverView Connector"
- Description — e.g. "Read-only inventory and vulnerability export to OverView"
- Key duration — choose the validity period allowed by your security policy
- Click Continue to Permissions.
- Set every permission to Read.
- Save the key, then copy it and provide it to OverView along with your tenant name.
The API key is displayed only once, at creation. If you leave the page without copying it, you will need to create a new one.
The key is created with a fixed duration. Imports will start failing once it expires, so renew it before its expiry date and provide the new key to OverView.
Security Best Practices
- Create a dedicated API key for the OverView integration rather than reusing one shared with another tool.
- Grant read-only permissions — OverView only needs to read inventory, identity and vulnerability data.
- Store the API key securely; it is shown only once and cannot be retrieved afterwards.
- Rotate the key regularly according to your organization's security policy, and before its expiry date.
Official Documentation
XM Cyber does not publish a public API reference. The API documentation is available from within the XM Cyber console or through your XM Cyber support contact.
Alternative: file import through DropPoint
The API access described above is the recommended method for this connector. Where it is not available (a segregated network, a version or licence without API, an export you already produce), OverView accepts file exports, to be uploaded to the bucket dedicated to XM Cyber.
Bucket : s3://xmcyber/
Example : s3://xmcyber/export.csv
The procedure is described in the OverView DropPoint guide: generating credentials, configuring the client, then sending files from the OverView web interface, the AWS CLI or an SDK. Its examples come pre-filled with this bucket when you follow this link.