---
title: Natrix
slug: connectors/natrix
docTags: 
createdAt: 2026-06-09T16:30:15.834Z
---

Natrix is a security platform that enhances threat detection and response through advanced alert management and analytics.

Natrix is a comprehensive security platform designed to manage and analyze alerts effectively. This connector allows Swimlane Turbine users to seamlessly assign alerts to analysts and update alert statuses within Natrix. By integrating Natrix with Swimlane Turbine, security teams can automate alert management processes, ensuring timely responses and efficient workflow management. This integration enhances the capabilities of security operations by providing streamlined alert handling and status updates, reducing manual intervention and improving response times.

## Prerequisites

Before you can use the Natrix connector for Turbine, you'll need access to the Natrix API. This requires the following:

- OAuth 2.0 Resource Owner Password Credentials authentication using the following parameters:
  - URL: The endpoint for accessing the Natrix API.
  - Client ID: The identifier for your application registered with Keycloak.
  - Username: The username for authenticating against the Natrix API.
  - Password: The password associated with the username for authentication.
  - Client Secret: A secret key used in conjunction with the client ID for secure authentication.

## Capabilities

This Connector provides the following capabilities:

- Capabilities
- Go
- Here
- e.g. Manage Firewall Policies instead of listing each individual tasks

### Limitations

Include information about known limitations here, including supported or minimum versions, especially
known unsupported versions.

## Asset Setup

The content here should discuss asset setup in a conversational manner. Be sure to include any known login
and test connection errors.

## Tasks Setup

Special task setup as needed depending on plugin, exclude if empty.

Known available allowed input options from enum type selection

## Notes

- Any other notes not fitting other sections go here.
- Any reference URLs to external docs or other resources

# Configurations

## Natrix Password Credentials

Authenticates using OAuth 2.0 Resource Owner Password Credentials grant against Keycloak.

### Configuration Parameters

| **Parameter**  | **Description**                                                                                     | **Type** | **Required** |
| -------------- | --------------------------------------------------------------------------------------------------- | -------- | ------------ |
| url            | Base URL of the Natrix server (e.g., [https://soc-master01.soc.lan](https://soc-master01.soc.lan)). | string   | Required     |
| client\_id     | OAuth2 client ID registered in Keycloak (e.g., master).                                             | string   | Required     |
| client\_secret | OAuth2 client secret registered in Keycloak.                                                        | string   | Required     |
| username       | Natrix user email address.                                                                          | string   | Required     |
| password       | Natrix user password.                                                                               | string   | Required     |
| verify\_ssl    | Verify SSL certificate.                                                                             | boolean  | Optional     |
| http\_proxy    | A proxy to route requests through.                                                                  | string   | Optional     |

# Actions

## Assign Alert

Assign a Natrix alert or group of alerts to an analyst using event ID, sensor index, assigned user, and action scope.

### Endpoint

- **URL:** `soctopus/api/alert/assign`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                              |
| ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------ |
| `event_id`        | string   | Optional     | Elasticsearch document ID of the alert.                                                                      |
| `sensor_index`    | string   | Optional     | Sensor and index in format "\<sensor\_name>:\<index\_name>" (e.g., sen01\_heavynode\:elastalert-2026.04.21). |
| `assigned_user`   | string   | Optional     | Analyst email address registered in Natrix.                                                                  |
| `action_scope`    | string   | Optional     | Scope of the assignment.                                                                                     |

### Input Example

`{"event_id":"string","sensor_index":"string","assigned_user":"string","action_scope":"event_id"}`

## Set Alert Status

Update the status of one or more Natrix alerts using event\_id, sensor\_index, event\_status, and action\_scope.

### Endpoint

- **URL:** `soctopus/api/alert/setstatus`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                              |
| ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------ |
| `event_id`        | string   | Optional     | Elasticsearch document ID of the alert.                                                                      |
| `sensor_index`    | string   | Optional     | Sensor and index in format "\<sensor\_name>:\<index\_name>" (e.g., sen01\_heavynode\:elastalert-2026.04.21). |
| `event_status`    | string   | Optional     | New status for the alert.                                                                                    |
| `action_scope`    | string   | Optional     | Scope of the status change.                                                                                  |
| `comment`         | string   | Optional     | Optional free-text comment stored with the status change.                                                    |

### Input Example

`{"event_id":"string","sensor_index":"string","event_status":"active","action_scope":"event_id","comment":"string"}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |