--- title: AlienVault USM Central slug: connectors/alienvault-usm-central docTags: createdAt: 2026-06-09T16:29:50.839Z --- The AlienVault USM Central connector enables streamlined integration with Swimlane for enhanced security event management and automated response actions. AlienVault USM Central is a comprehensive threat detection and incident response platform that centralizes security monitoring across distributed environments. By integrating with Swimlane Turbine, users can automate the ingestion and analysis of alarms, streamline asset management, and access critical security dictionaries. This connector empowers security teams to efficiently manage and respond to threats by leveraging USM Central's rich alarm data and asset information within the Turbine ecosystem, enhancing overall security posture and response capabilities. ## Prerequisites To effectively utilize the AlienVault USM Central connector with Swimlane, ensure you have the following prerequisites: - Custom authentication credentials with the following parameters: - URL: The endpoint URL for the AlienVault USM Central API. - Client ID: Your unique identifier for AlienVault USM Central API access. - Client Secret: A secret key provided by AlienVault for authenticating API requests. ## Capabilities The AlienVault USM Central connector provides the following capabilities: - Get Alarms - Get Assets - Get Dictionaries - Get Alarms ID ## Notes - [AlienVault APIs](https://www.alienvault.com/documentation/api/av-apis.htm) ## Additional Documentation - [AlienVault USM Central Connector Documentation](https://docs.swimlane.com/connectors/alienvault-usm-central) - [AlienVault USM Central API Documentation](https://www.alienvault.com/documentation/api/av-apis.htm) # Configurations ## USM Central Oauth Authentication Authenticates using Client ID and Client Secret. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | Client ID | string | Required | | client\_secret | Client Secret | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Retrieve Alarm Retrieves detailed information for a specified alarm using its unique ID (UUID) in AlienVault USM Central. ### Endpoint - **URL:** `api/1.1/alarms/{{alarmid}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.alarmid` | string | Required | Parameters for the Retrieve Alarm action | ### Input Example `{"path_parameters":{"alarmid":"971918fd-a589-648a-5a80-1ffcda2a8365"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `results` | object | Result of the operation | | `results.alarm` | object | Result of the operation | | `results.alarm.rule_intent` | string | Result of the operation | | `results.alarm.app_type` | string | Type of the resource | | `results.alarm.alarm_sensor_sources` | array | Result of the operation | | `results.alarm.source_username` | string | Name of the resource | | `results.alarm.destination_name` | string | Name of the resource | | `results.alarm.rule_dictionary` | string | Result of the operation | | `results.alarm.timestamp_occured` | string | Result of the operation | | `results.alarm.uuid` | string | Unique identifier | | `results.alarm.authentication_type` | string | Type of the resource | | `results.alarm.needs_enrichment` | boolean | Result of the operation | | `results.alarm.event_type` | string | Type of the resource | | `results.alarm.rule_method` | string | HTTP method to use | | `results.alarm.priority_label` | string | Result of the operation | | `results.alarm.suppressed` | string | Result of the operation | | `results.alarm.app_id` | string | Unique identifier | | `results.alarm.has_alarm` | string | Result of the operation | | `results.alarm.number_of_events` | number | Result of the operation | | `results.alarm.source_name` | string | Name of the resource | | `results.alarm.timestamp_received` | string | Result of the operation | | `results.alarm.error_message` | string | Result of the operation | | `results.alarm.source_asset_id` | string | Unique identifier | | `results.alarm.alarm_destination_zones` | array | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=f...","Content-Encoding":"gzip","Vary":"Accept-Encoding","Strict-Transport-Security":"max-age=31536000","request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","client-request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"West US\n 2\",\"Sl...` ## Retrieve Alarms Search for and retrieve alarm details from AlienVault USM Central using specified criteria in the request body. ### Endpoint - **URL:** `api/1.1/alarms/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ----------------------------- | | `page` | number | Optional | Parameter for Retrieve Alarms | | `size` | number | Optional | Parameter for Retrieve Alarms | | `find` | object | Optional | Parameter for Retrieve Alarms | | `find.alarm.suppressed` | array | Optional | Parameter for Retrieve Alarms | | `sort` | object | Optional | Parameter for Retrieve Alarms | | `sort.alarm.timestamp_occured` | string | Optional | Parameter for Retrieve Alarms | | `range` | object | Optional | Parameter for Retrieve Alarms | | `range.alarm.timestamp_occured` | object | Optional | Parameter for Retrieve Alarms | | `range.alarm.timestamp_occured.gte` | string | Optional | Parameter for Retrieve Alarms | | `range.alarm.timestamp_occured.lte` | string | Optional | Parameter for Retrieve Alarms | | `range.alarm.timestamp_occured.timeZone` | string | Optional | Parameter for Retrieve Alarms | ### Input Example `{"json_body":{"page":1,"size":20,"find":{"alarm.suppressed":["false"]},"sort":{"alarm.timestamp_occured":"desc"},"range":{"alarm.timestamp_occured":{"gte":"now-7d","lte":"now","timeZone":"-0500"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.alarm` | object | Result of the operation | | `results.alarm.rule_intent` | string | Result of the operation | | `results.alarm.app_type` | string | Type of the resource | | `results.alarm.alarm_sensor_sources` | array | Result of the operation | | `results.alarm.source_username` | string | Name of the resource | | `results.alarm.destination_name` | string | Name of the resource | | `results.alarm.rule_dictionary` | string | Result of the operation | | `results.alarm.account_id` | string | Unique identifier | | `results.alarm.timestamp_occured` | string | Result of the operation | | `results.alarm.uuid` | string | Unique identifier | | `results.alarm.authentication_type` | string | Type of the resource | | `results.alarm.needs_enrichment` | boolean | Result of the operation | | `results.alarm.event_type` | string | Type of the resource | | `results.alarm.rule_method` | string | HTTP method to use | | `results.alarm.priority_label` | string | Result of the operation | | `results.alarm.suppressed` | string | Result of the operation | | `results.alarm.app_id` | string | Unique identifier | | `results.alarm.has_alarm` | string | Result of the operation | | `results.alarm.number_of_events` | number | Result of the operation | | `results.alarm.source_name` | string | Name of the resource | | `results.alarm.timestamp_received` | string | Result of the operation | | `results.alarm.error_message` | string | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=f...","Content-Encoding":"gzip","Vary":"Accept-Encoding","Strict-Transport-Security":"max-age=31536000","request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","client-request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"West US 2\",\"Slice\":\"E\"...` ## Retrieve Assets Search for and retrieve asset information from AlienVault USM Central, utilizing a JSON body for input parameters. ### Endpoint - **URL:** `api/1.1/assets/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ----------------------------- | | `page` | number | Optional | Parameter for Retrieve Assets | | `size` | number | Optional | Parameter for Retrieve Assets | | `find` | object | Optional | Parameter for Retrieve Assets | | `find.asset.hipaa` | array | Optional | Parameter for Retrieve Assets | | `sort` | object | Optional | Parameter for Retrieve Assets | | `sort.asset.dateFound` | string | Optional | Parameter for Retrieve Assets | | `range` | object | Optional | Parameter for Retrieve Assets | | `range.asset.dateFound` | object | Optional | Parameter for Retrieve Assets | | `range.asset.dateFound.gte` | string | Optional | Parameter for Retrieve Assets | | `range.asset.dateFound.lte` | string | Optional | Parameter for Retrieve Assets | | `range.asset.dateFound.timeZone` | string | Optional | Parameter for Retrieve Assets | ### Input Example `{"json_body":{"page":1,"size":20,"find":{"asset.hipaa":["false"]},"sort":{"asset.dateFound":"desc"},"range":{"asset.dateFound":{"gte":"now-7d","lte":"now","timeZone":"-0500"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.asset` | object | Result of the operation | | `results.asset.hipaa` | string | Result of the operation | | `results.asset.operatingSystem` | object | Result of the operation | | `results.asset.hostname` | string | Name of the resource | | `results.asset.id` | string | Unique identifier | | `results.asset.deviceType` | object | Type of the resource | | `results.asset.assetOriginUUID` | string | Unique identifier | | `results.asset.nmapExcludeFromScan` | object | Result of the operation | | `results.asset.knownAsset` | string | Result of the operation | | `results.asset.configurationCount` | string | Result of the operation | | `results.asset.assetOriginName` | string | Name of the resource | | `results.asset.operatingSystemSource` | object | Result of the operation | | `results.asset.assetOriginType` | string | Type of the resource | | `results.asset.alarmCount` | string | Result of the operation | | `results.asset.dateUpdated` | string | Result of the operation | | `results.asset.vulnerabilityCount` | string | Result of the operation | | `results.asset.eventCount` | string | Result of the operation | | `results.asset.logo` | object | Result of the operation | | `results.asset.rootDeviceType` | string | Type of the resource | | `results.asset.name` | string | Name of the resource | | `results.asset.dateFound` | string | Result of the operation | | `results.asset.region` | string | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=f...","Content-Encoding":"gzip","Vary":"Accept-Encoding","Strict-Transport-Security":"max-age=31536000","request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","client-request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"West US 2\",\"Slice\":\"E\"...` ## Retrieve Dictionaries Obtain the dictionaries from AlienVault USM Central, which contain structured information for use in analysis and reporting. ### Endpoint - **URL:** `api/1.1/dictionaries` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------------- | -------- | ----------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `BarracudaRules-Dict` | object | Output field: BarracudaRules-Dict | | `BarracudaRules-Dict.Strategy` | object | Output field: BarracudaRules-Dict.Strategy | | `BarracudaRules-Dict.Strategy.Configuration Change` | array | Output field: BarracudaRules-Dict.Strategy.Configuration Change | | `BarracudaRules-Dict.Strategy.Suspicious Security Critical Event` | array | Output field: BarracudaRules-Dict.Strategy.Suspicious Security Critical Event | | `BarracudaRules-Dict.Intent` | object | Output field: BarracudaRules-Dict.Intent | | `BarracudaRules-Dict.Intent.Reconnaissance & Probing` | array | Output field: BarracudaRules-Dict.Intent.Reconnaissance & Probing | | `BarracudaRules-Dict.Intent.Environmental Awareness` | array | Output field: BarracudaRules-Dict.Intent.Environmental Awareness | | `BarracudaRules-Dict.Method` | object | HTTP method to use | | `BarracudaRules-Dict.Method.Multiple Cross-Site Request Forgery attempts` | array | HTTP method to use | | `SuricataMalwareRules-Dict` | object | Output field: SuricataMalwareRules-Dict | | `SuricataMalwareRules-Dict.Strategy` | object | Output field: SuricataMalwareRules-Dict.Strategy | | `SuricataMalwareRules-Dict.Strategy.Phishing` | array | Output field: SuricataMalwareRules-Dict.Strategy.Phishing | | `SuricataMalwareRules-Dict.Intent` | object | Output field: SuricataMalwareRules-Dict.Intent | | `SuricataMalwareRules-Dict.Intent.Reconnaissance & Probing` | array | Output field: SuricataMalwareRules-Dict.Intent.Reconnaissance & Probing | | `SuricataMalwareRules-Dict.Method` | object | HTTP method to use | | `SuricataMalwareRules-Dict.Method.Cylance - Multiple AV Detections` | array | HTTP method to use | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=f...","Content-Encoding":"gzip","Vary":"Accept-Encoding","Strict-Transport-Security":"max-age=31536000","request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","client-request-id":"cccf20e1-f938-4314-a076-4bebaff51f34","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"West US 2\",\"Slice\":\"E\"...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | no-store, no-cache | | client-request-id | HTTP response header: client-request-id | cccf20e1-f938-4314-a076-4bebaff51f34 | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Type | The media type of the resource | application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=false;charset=utf-8 | | Date | The date and time at which the message was originated | Thu, 29 Dec 2022 20:37:23 GMT | | OData-Version | HTTP response header: OData-Version | 4.0 | | reason | HTTP response header: reason | Created | | request-id | HTTP response header: request-id | cccf20e1-f938-4314-a076-4bebaff51f34 | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | x-ms-ags-diagnostic | HTTP response header: x-ms-ags-diagnostic | \{"ServerInfo":\{"DataCenter":"West US | ```javascript 2","Slice":"E","Ring":"1","ScaleUnit":"002","RoleInstance":"MWH0EPF00070F96"}} | ```