Adlumin
The Adlumin connector enables streamlined integration with Adlumin's security platform, facilitating automated data retrieval and analysis for enhanced threat detection and response.
Adlumin delivers a cutting-edge security and compliance automation platform, designed to provide comprehensive visibility into an organization's cybersecurity posture. The Adlumin Turbine Connector enables users to seamlessly integrate Adlumin's rich security data into Swimlane's low-code automation workflows. By leveraging this connector, users can automate the retrieval and analysis of detections, device data, endpoint information, and network insights, enhancing their ability to rapidly respond to threats and maintain compliance. The integration empowers security teams to efficiently manage and analyze large volumes of security data, streamline incident response, and bolster their overall security operations.
Limitations
None to date.
Supported Versions
This connector supports the latest version of the Adlumin API.
Additional Docs
None to date.
Configuration
Prerequisites
To effectively utilize the Adlumin connector within the Swimlane Turbine platform, ensure you have the following prerequisites:
- API Key Authentication:
- URL: The base endpoint for Adlumin's API services.
- API Key: A unique identifier to authenticate requests to Adlumin's API.
- Tenant ID: The specific tenant domain within Adlumin to scope API access.
Authentication Methods
- API Key Authentication for the Adlumin API with the following parameters:
- URL: The base endpoint for Adlumin API access
- API Key: Your unique identifier to authenticate with the Adlumin API
- Tenant ID: The specific identifier for your organization within Adlumin
Capabilities
This Adlumin Connector provides the following capabilities:
- Get Detections
- Get Device Data
- Get Endpoint Data
- Query Complete Endpoint Data
- Query Detections
- Query Device Data
- Query Endpoint Data
- Query Firewall
- Query Network Data
Get Detections
- Searches across all detections within the Adlumin platform, including detections that have been acknowledged and/or suppressed from the dashboard.
Get Device Data
- Ingest all device data.
Get Endpoint Data
- Ingest all endpoint data.
Query Complete Endpoint Data
- Search all endpoint data along with Endpoint Security, Carbon Black, and Cylance indexes.
Query Detections
- Search all detections in Adlumin platform.
Query Device Data
- Search all device data indexes.
Query Endpoint Data
- Search all Adlumin data points on Windows and Linux systems.
Query Firewall
- Search the Firewall device data index.
Query Network Data
- Search across Firewall, Network Security Devices, and VPN indexes.
Configurations
Adlumin API Key Authentication
Authenticates using an API Key and Tenant ID for the Adlumin API.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
x-api-key | Adlumin API key. | string | Required |
tenant_id | Adlumin tenant ID. | string | Required |
verify_ssl | Verify SSL certificate. | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Detections
Retrieves all detections from the Adlumin platform, including acknowledged or suppressed ones, based on query and record_pages parameters.
Endpoint
- URL: v1/detections
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.query | string | Required | Priority level of the detections (low, medium, high, or critical). |
parameters.record_pages | number | Required | The number of pages of 1000 records to ingest. |
Input Example
{"parameters":{"query":"Critical","record_pages":2}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
records_returned | number | Output field: records_returned |
total_records | number | Output field: total_records |
records | array | Output field: records |
records.detection_id | number | Unique identifier |
records.detection_type | string | Type of the resource |
records.detection_sub_type | object | Type of the resource |
records.event_time | string | Time value |
records.source_host | string | Output field: records.source_host |
records.destination_host | string | Output field: records.destination_host |
records.account_used | string | Output field: records.account_used |
records.alert_type | string | Type of the resource |
records.severity | string | Output field: records.severity |
records.acknowledged | boolean | Output field: records.acknowledged |
records.acknowledged_by | string | Output field: records.acknowledged_by |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"records_returned":3,"total_records":3,"records":[{}]}}
Get Device Data
Ingest comprehensive device data from Adlumin, with the option to specify the number of record pages.
Endpoint
- URL: v1/device_data
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.record_pages | number | Required | The number of pages of 1000 records to ingest. |
Input Example
{"parameters":{"record_pages":2}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Endpoint Data
Ingest comprehensive endpoint data from Adlumin, with the option to specify record pagination.
Endpoint
- URL: v1/endpoint_data
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.record_pages | number | Required | The number of pages of 1000 records to ingest. |
Input Example
{"parameters":{"record_pages":2}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Query Complete Endpoint Data
Retrieve comprehensive endpoint data, including Endpoint Security, Carbon Black, and Cylance indexes from Adlumin.
Endpoint
- URL: v1/complete_endpoint_data
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.start | string | Optional | Match records created after this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.end | string | Optional | Match records created before this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.scroll_id | string | Optional | Use to get subsequent records when more than 1000 are returned. Get it from the first call to that endpoint. |
Input Example
{"parameters":{"start":"2019-01-01-00:00:00","end":"2023-01-01-00:00:00","scroll_id":"DnF1ZXJ5VGhlbkZldGNoFA"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Query Detections
Executes a search for all detections within the Adlumin platform using a specified query parameter.
Endpoint
- URL: v1/detections
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.query | string | Required | Search query string; match all records containing the string. |
parameters.scroll_id | string | Optional | Use to get subsequent records when more than 1000 are returned. Get it from the first call to that endpoint. |
Input Example
{"parameters":{"query":"Critical","scroll_id":"DnF1ZXJ5VGhlbkZldGNoFA"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Query Device Data
Retrieve comprehensive device data from all indexes within the Adlumin platform.
Endpoint
- URL: v1/device_data
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.query | string | Optional | Search query string; match all records containing the string. |
parameters.start | string | Optional | Match records created after this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.end | string | Optional | Match records created before this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.scroll_id | string | Optional | Use to get subsequent records when more than 1000 are returned. Get it from the first call to that endpoint. |
Input Example
{"parameters":{"query":"Critical","start":"2019-01-01-00:00:00","end":"2023-01-01-00:00:00","scroll_id":"DnF1ZXJ5VGhlbkZldGNoFA"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Query Endpoint Data
Retrieve comprehensive data points from Windows and Linux systems within the Adlumin platform.
Endpoint
- URL: v1/endpoint_data
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.start | string | Optional | Match records created after this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.end | string | Optional | Match records created before this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.scroll_id | string | Optional | Use to get subsequent records when more than 1000 are returned. Get it from the first call to that endpoint. |
Input Example
{"parameters":{"start":"2019-01-01-00:00:00","end":"2023-01-01-00:00:00","scroll_id":"DnF1ZXJ5VGhlbkZldGNoFA"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Query Firewall
Retrieve indexed data from a Firewall device within the Adlumin platform, facilitating targeted searches.
Endpoint
- URL: v1/firewall
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.start | string | Optional | Match records created after this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.end | string | Optional | Match records created before this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.scroll_id | string | Optional | Use to get subsequent records when more than 1000 are returned. Get it from the first call to that endpoint. |
Input Example
{"parameters":{"start":"2019-01-01-00:00:00","end":"2023-01-01-00:00:00","scroll_id":"DnF1ZXJ5VGhlbkZldGNoFA"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Query Network Data
Executes a search across Firewall, Network Security Devices, and VPN indexes in Adlumin to retrieve relevant data.
Endpoint
- URL: v1/network_data
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.query | string | Optional | Search query string; match all records containing the string. |
parameters.start | string | Optional | Match records created after this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.end | string | Optional | Match records created before this date/time (YYYY-MM-DD-HH:MM:SS). |
parameters.scroll_id | string | Optional | Use to get subsequent records when more than 1000 are returned. Get it from the first call to that endpoint. |
Input Example
{"parameters":{"query":"Critical","start":"2019-01-01-00:00:00","end":"2023-01-01-00:00:00","scroll_id":"DnF1ZXJ5VGhlbkZldGNoFA"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |