--- title: Cohesity Helios slug: connectors/cohesity-helios docTags: createdAt: 2026-06-09T16:30:22.671Z --- Cohesity Helios is a data management platform that simplifies data protection and utilization across hybrid and multi-cloud environments. Cohesity Helios is a comprehensive data management platform that provides centralized control and visibility across your data infrastructure. This connector allows Swimlane Turbine users to seamlessly integrate with Cohesity Helios to retrieve and monitor alerts, including ransomware alerts, for enhanced security analysis. By leveraging this integration, users can automate the collection and analysis of critical alerts, enabling faster response times and improved threat detection capabilities within their security operations. This Connector integrates Cohesity Helios with Swimlane Turbine. ## Prerequisites Before you can use the Cohesity Helios connector for Turbine, you'll need access to the Cohesity Helios API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing the Cohesity Helios API. - API Key: A valid API key to authenticate requests to the Cohesity Helios API. ## Capabilities This Connector provides the following capabilities: - Get Helios Alerts - Get Ransomeware Alerts ## Notes - [API Doc](https://developer.cohesity.com/apidocs/helios/v2-api) ## Additional Documentation - [Cohesity Helios Connector Documentation](https://docs.swimlane.com/connectors/cohesity-helios) - [Cohesity Helios API Documentation](https://developer.cohesity.com/apidocs/helios/v2-api) # Configurations ## Cohesity Helios API Key Authentication Authenticates using an API Key. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | apiKey | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Helios Alerts Get the list of Helios alerts from Cohesity Helios for monitoring and analysis. ### Endpoint - **URL:** `v2/mcm/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ----------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -- | | `headers` | object | Optional | HTTP headers for the request | | | `headers.regionId` | string | Optional | This parameter uniquely represents a region and is used for making Helios calls to a specific region. | | | `parameters.alertIdList` | array | Optional | Filter by list of alert ids. | | | `parameters.alertStateList` | array | Optional | Filter by list of alert states. | | | `parameters.alertTypeList` | array | Optional | Filter by list of alert types. | | | `parameters.alertSeverityList` | array | Optional | Filter by list of alert severity types. | | | `parameters.regionIds` | array | Optional | Filter by list of region ids. | | | `parameters.clusterIdentifiers` | array | Optional | Filter by list of cluster IDs. | | | `parameters.startDateUsecs` | number | Optional | Specifies the start time of the alerts to be returned. All the alerts returned are raised after the specified start time. This value should be in Unix timestamp epoch in microseconds. | | | `parameters.endDateUsecs` | number | Optional | Specifies the end time of the alerts to be returned. All the alerts returned are raised before the specified end time. This value should be in Unix timestamp epoch in microseconds. | | | `parameters.maxAlerts` | number | Optional | Specifies maximum number of alerts to return. | | | `parameters.alertCategoryList` | array | Optional | Filter by list of alert categories. | | | `parameters.alertTypeBucketList` | array | Optional | Filter by list of alert type buckets. | | | `parameters.alertPropertyKeyList` | array | Optional | Specifies list of the alert property keys to query. | | | `parameters.alertPropertyValueList` | array | Optional | Specifies list of the alert property value, multiple values for one key should be joined by ' | '. | ### Input Example `{"headers":{"regionId":"string"},"parameters":{"alertIdList":["string"],"alertStateList":["string"],"alertTypeList":[123],"alertSeverityList":["string"],"regionIds":["string"],"clusterIdentifiers":["string"],"startDateUsecs":123,"endDateUsecs":123,"maxAlerts":123,"alertCategoryList":["string"],"alertTypeBucketList":["string"],"alertPropertyKeyList":["string"],"alertPropertyValueList":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 20 Mar 2024 06:17:44 GMT","Content-Type":"application/json","Content-Length":"5","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","x-prisma-event-id":"850161ab-d9e4-46ce-70f0-71f12abaa64c","content-security-policy":"frame-ancestors 'self';","x-xss-protection":"1; mode=block","x-content-type-options":"nosniff","referrer-policy":"strict-origin-when-cross-origin","x-download-options":"noopen","x-dns-prefetch-control":"off","strict-transpor...` ## Get Ransomware Alerts Retrieve ransomware alerts from Cohesity Helios for monitoring and analysis. ### Endpoint - **URL:** `mcm/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------- | | `headers` | object | Optional | HTTP headers for the request | | `headers.regionId` | string | Optional | This parameter uniquely represents a region and is used for making Helios calls to a specific region. | | `parameters.alertStateList` | array | Optional | Filter by list of alert states. | | `parameters.alertSeverityList` | array | Optional | Filter by list of alert severity types. | | `parameters.regionIds` | array | Optional | Filter by list of region ids. | | `parameters.clusterIdentifiers` | array | Optional | Filter by list of cluster IDs. | | `parameters.startDateTime` | string | Optional | Start Datetime in ISO format. | | `parameters.endDateTime` | string | Optional | Start Datetime in ISO format. | | `parameters.maxAlerts` | number | Optional | Specifies maximum number of alerts to return. | ### Input Example `{"headers":{"regionId":"string"},"parameters":{"alertStateList":["string"],"alertSeverityList":["string"],"regionIds":["string"],"clusterIdentifiers":["string"],"startDateTime":"string","endDateTime":"string","maxAlerts":123}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | ------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `ransomware_alerts` | array | Output field: ransomware\_alerts | | `ransomware_alerts.alert_id` | string | Unique identifier | | `ransomware_alerts.alert_name` | string | Name of the resource | | `ransomware_alerts.cluster_name` | string | Name of the resource | | `ransomware_alerts.occurrence_time` | string | Time value | | `ransomware_alerts.severity` | string | Output field: ransomware\_alerts.severity | | `ransomware_alerts.alert_description` | string | Output field: ransomware\_alerts.alert\_description | | `ransomware_alerts.alert_cause` | string | Output field: ransomware\_alerts.alert\_cause | | `ransomware_alerts.anomalous_object_name` | string | Name of the resource | | `ransomware_alerts.anomalous_object_env` | string | Output field: ransomware\_alerts.anomalous\_object\_env | | `ransomware_alerts.anomaly_strength` | string | Output field: ransomware\_alerts.anomaly\_strength | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 05 Apr 2024 05:50:40 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","x-prisma-event-id":"d135b113-d6b2-bbc3-a345-7b8cfe643982","content-encoding":"gzip","vary":"Accept-Encoding","content-security-policy":"frame-ancestors 'self';","x-xss-protection":"1; mode=block","x-content-type-options":"nosniff","referrer-policy":"strict-origin-when-cross-origin","x-download-optio...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 5 | | content-security-policy | HTTP response header: content-security-policy | frame-ancestors 'self'; | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Fri, 05 Apr 2024 05:50:40 GMT | | feature-policy | HTTP response header: feature-policy | camera 'none';microphone 'none';geolocation 'none';encrypted-media 'none';payment 'none';usb 'none'; | | referrer-policy | HTTP response header: referrer-policy | strict-origin-when-cross-origin | | strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Accept-Encoding | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-dns-prefetch-control | HTTP response header: x-dns-prefetch-control | off | | x-download-options | HTTP response header: x-download-options | noopen | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | x-prisma-event-id | HTTP response header: x-prisma-event-id | 850161ab-d9e4-46ce-70f0-71f12abaa64c | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |