[{"data":1,"prerenderedAt":391},["ShallowReactive",2],{"connector-en-xmcyber":3},{"id":4,"title":5,"body":6,"category":381,"description":382,"extension":383,"meta":384,"navigation":385,"path":386,"seo":387,"sidebar":388,"stem":389,"updatedAt":381,"__hash__":390},"connectorsEn\u002Fen\u002Fconnectors\u002Fxmcyber.md","XM Cyber",{"type":7,"value":8,"toc":367},"minimark",[9,13,18,21,37,41,63,67,70,132,135,189,193,196,215,222,226,231,301,308,314,318,343,347,352,362],[10,11,12],"p",{},"The XM Cyber connector allows OverView to retrieve your devices, identities, installed software and vulnerabilities directly from your XM Cyber tenant for a consolidated view of your exposure.",[14,15,17],"h2",{"id":16},"objective","Objective",[10,19,20],{},"The XM Cyber connector retrieves the following information:",[22,23,24,28,31,34],"ul",{},[25,26,27],"li",{},"Devices — machines covered by a sensor, agentless machines, and Active Directory computers, with their hostname, FQDN, IP and MAC addresses, hardware, operating system, sensor version and site",[25,29,30],{},"Identities — Active Directory users, Azure users and Azure service principals, with their privilege flags, MFA status and password policy attributes",[25,32,33],{},"Installed software and its CVEs, from the Vulnerability Risk Management (VRM) module, with CVSS, EPSS and KEV severity data",[25,35,36],{},"Optionally, hosts seen by the Passive Discovery Scan — the machines no sensor covers, with their MAC address and listening ports",[14,38,40],{"id":39},"prerequisites","Prerequisites",[22,42,43,50,57],{},[25,44,45,46],{},"Access to the XM Cyber console with the rights to create API keys under ",[47,48,49],"strong",{},"System Config",[25,51,52,53,56],{},"The ",[47,54,55],{},"Vulnerability Risk Management (VRM)"," module enabled on your tenant, for installed software and CVEs",[25,58,52,59,62],{},[47,60,61],{},"Passive Discovery Scan"," module enabled on your tenant, if you want the unmanaged hosts it discovers",[14,64,66],{"id":65},"information-to-provide-to-overview","Information to provide to OverView",[10,68,69],{},"Contact OverSOC support to configure this connector. You will need to provide:",[71,72,73,86],"table",{},[74,75,76],"thead",{},[77,78,79,83],"tr",{},[80,81,82],"th",{},"Field",[80,84,85],{},"Description",[87,88,89,109,119],"tbody",{},[77,90,91,97],{},[92,93,94],"td",{},[47,95,96],{},"Tenant",[92,98,99,100,104,105,108],{},"Your tenant name alone, e.g. ",[101,102,103],"code",{},"acme"," — not a URL. The console URL ",[101,106,107],{},"https:\u002F\u002Facme.clients.xmcyber.com"," is built from it",[77,110,111,116],{},[92,112,113],{},[47,114,115],{},"API Key",[92,117,118],{},"The API key created in the procedure below",[77,120,121,126],{},[92,122,123],{},[47,124,125],{},"Domain",[92,127,128,129],{},"Only if your deployment does not sit on the public SaaS domain. Defaults to ",[101,130,131],{},"clients.xmcyber.com",[10,133,134],{},"The following options can also be set, and can be left at their default values:",[71,136,137,149],{},[74,138,139],{},[77,140,141,144,147],{},[80,142,143],{},"Option",[80,145,146],{},"Default",[80,148,85],{},[87,150,151,164,176],{},[77,152,153,158,161],{},[92,154,155],{},[47,156,157],{},"Include identities",[92,159,160],{},"Enabled",[92,162,163],{},"Retrieve Active Directory and Azure accounts",[77,165,166,171,173],{},[92,167,168],{},[47,169,170],{},"Include VRM",[92,172,160],{},[92,174,175],{},"Retrieve installed software and CVEs from the VRM module",[77,177,178,183,186],{},[92,179,180],{},[47,181,182],{},"Include Passive Discovery Scan",[92,184,185],{},"Disabled",[92,187,188],{},"Retrieve the hosts seen on the network without a sensor. It imports every host observed on the wire, which can grow your estate substantially",[14,190,192],{"id":191},"required-permissions","Required Permissions",[10,194,195],{},"The connector is strictly read-only. The API key needs read access to:",[22,197,198,205,210],{},[25,199,200,201,204],{},"the ",[47,202,203],{},"entity inventory"," — devices and identities",[25,206,200,207,209],{},[47,208,55],{}," module — installed software and CVEs",[25,211,200,212,214],{},[47,213,61],{},", only if you enable that option",[10,216,217,218,221],{},"Setting every permission to ",[47,219,220],{},"Read"," when creating the key, as described below, covers all of them. Never grant write permissions.",[14,223,225],{"id":224},"procedure","Procedure",[227,228,230],"h3",{"id":229},"create-an-api-key-in-xm-cyber","Create an API key in XM Cyber",[232,233,234,241,250,260,266,288,293,298],"ol",{},[25,235,236,237,240],{},"Sign in to your XM Cyber console at ",[101,238,239],{},"https:\u002F\u002F\u003Ctenant>.clients.xmcyber.com",".",[25,242,243,244,246,247,240],{},"Navigate to ",[47,245,49],{}," > ",[47,248,249],{},"Integrations",[25,251,252,253,256,257,240],{},"Under ",[47,254,255],{},"XM Cyber API keys",", click ",[47,258,259],{},"View \u002F generate API keys",[25,261,262,263,240],{},"Click ",[47,264,265],{},"Create New API Key",[25,267,268,269],{},"Fill in the key details:\n",[22,270,271,277,282],{},[25,272,273,276],{},[47,274,275],{},"Application name"," — e.g. \"OverView Connector\"",[25,278,279,281],{},[47,280,85],{}," — e.g. \"Read-only inventory and vulnerability export to OverView\"",[25,283,284,287],{},[47,285,286],{},"Key duration"," — choose the validity period allowed by your security policy",[25,289,262,290,240],{},[47,291,292],{},"Continue to Permissions",[25,294,295,296,240],{},"Set every permission to ",[47,297,220],{},[25,299,300],{},"Save the key, then copy it and provide it to OverView along with your tenant name.",[302,303,304,305],"caution",{},"API key",[10,306,307],{},"The API key is displayed only once, at creation. If you leave the page without copying it, you will need to create a new one.",[302,309,310,311],{},"Key expiry",[10,312,313],{},"The key is created with a fixed duration. Imports will start failing once it expires, so renew it before its expiry date and provide the new key to OverView.",[14,315,317],{"id":316},"security-best-practices","Security Best Practices",[22,319,320,327,334,337],{},[25,321,322,323,326],{},"Create a ",[47,324,325],{},"dedicated API key"," for the OverView integration rather than reusing one shared with another tool.",[25,328,329,330,333],{},"Grant ",[47,331,332],{},"read-only"," permissions — OverView only needs to read inventory, identity and vulnerability data.",[25,335,336],{},"Store the API key securely; it is shown only once and cannot be retrieved afterwards.",[25,338,339,342],{},[47,340,341],{},"Rotate the key"," regularly according to your organization's security policy, and before its expiry date.",[14,344,346],{"id":345},"official-documentation","Official Documentation",[302,348,349],{},[10,350,351],{},"XM Cyber does not publish a public API reference. The API documentation is available from within the XM Cyber console or through your XM Cyber support contact.",[22,353,354],{},[25,355,356],{},[357,358,5],"a",{"href":359,"rel":360},"https:\u002F\u002Fxmcyber.com",[361],"nofollow",[363,364],"s3-upload",{"bucket":365,"connector":5,"file":366},"xmcyber","export.csv",{"title":368,"searchDepth":369,"depth":369,"links":370},"",2,[371,372,373,374,375,379,380],{"id":16,"depth":369,"text":17},{"id":39,"depth":369,"text":40},{"id":65,"depth":369,"text":66},{"id":191,"depth":369,"text":192},{"id":224,"depth":369,"text":225,"children":376},[377],{"id":229,"depth":378,"text":230},3,{"id":316,"depth":369,"text":317},{"id":345,"depth":369,"text":346},null,"Connect OverView to XM Cyber to retrieve your devices, Active Directory and Azure identities, installed software and CVEs from the Vulnerability Risk Management module","md",{},true,"\u002Fen\u002Fconnectors\u002Fxmcyber",{"title":5,"description":382},{"label":5},"en\u002Fconnectors\u002Fxmcyber","EXewu5cL_RwTQj1K0gdTQ95mRk4T5vJ-s0suxyXOtOk",1791561314865]