--- title: Securonix Snypr slug: connectors/securonix-snypr docTags: createdAt: 2026-06-09T16:30:19.985Z --- Securonix SNYPR is a security analytics platform that uses machine learning to detect and respond to threats. Securonix SNYPR is a leading security analytics and operations management platform that provides advanced threat detection and response capabilities. The Securonix SNYPR connector for Swimlane Turbine enables seamless integration with Securonix's powerful SIEM interface, allowing users to automate security operations and enhance threat intelligence. By leveraging this integration, Swimlane Turbine users can efficiently query activity logs, retrieve top threats and violations, and manage incidents, thereby improving their security posture and response times. ## Prerequisites Before you can use the Securonix SNYPR connector for Turbine, you'll need access to the Securonix API. This requires the following: - HTTP Basic authentication using the following parameters: - URL: The endpoint URL for accessing the Securonix API. - Username: Your Securonix account username. - Password: The password associated with your Securonix account. ## Capabilities This connector provides the following capabilities: - Run Activity Query - Get Top Threats - Get Top Violations - Get Top Violators - List All Policies - List All Users - Retrieve List of Incidents Note: To get "All Violations by Policy Name", use "Run Activity Query" action with the query: `index=violation AND policyname = AND ` ## Asset Setup This connector asset requires an URL, Username and a Password to authenticate. ## Notes - [API Documentation](https://documentation.securonix.com/bundle/securonix-cloud-user-guide/page/content/rest-api-categories.htm) ## Additional Notes - **BASE\_URL** or **HOST\_URL** must be in the format: **HOSTNAME\_or\_IPADDRESS/Snypr** - While using the **Retrieve List of Incidents** action, please note that the parameter **tenantname** is optional for non-MSSP and is required to pass for MSSP and if needed, check here for documentation [Retrieve List of Incidents API Documentation](https://documentation.securonix.com/bundle/securonix-cloud-user-guide/page/content/rest-api-categories.htm#retrieve_list_of_incidents) ## Additional Documentation - [Securonix Snypr Connector Documentation](https://docs.swimlane.com/connectors/securonix-snypr) - [Securonix Snypr API Documentation](https://documentation.securonix.com/bundle/securonix-cloud-user-guide/page/content/rest-api-categories.htm) - [Securonix Snypr Authentication Guide](https://docs.swimlane.com/authentication-guides/securonix-snypr) # Configurations ## Securonix SNYPR Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Run Activity Query Run simple searches on the activity collection in Securonix SNYPR's Unified Defense SIEM interface. Requires query, eventtime\_from, and eventtime\_to parameters. Pipe or operator searches are not supported. ### Endpoint - **URL:** `Snypr/ws/spotter/index/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------- | | `parameters.query` | string | Required | Parameters for the Run Activity Query action | | `parameters.eventtime_from` | string | Required | Parameters for the Run Activity Query action | | `parameters.eventtime_to` | string | Required | Parameters for the Run Activity Query action | | `parameters.tz` | string | Optional | Parameters for the Run Activity Query action | | `parameters.prettyJson` | boolean | Optional | Parameters for the Run Activity Query action | | `parameters.max` | number | Optional | This parameter is only available for version 6.2 CU4 SP4 and above. | | `parameters.queryId` | string | Optional | This parameter is only available for version 6.2 CU4 SP4 and above. | ### Input Example `{"parameters":{"query":"index=activity AND resourcegroupname = \"carbonblackalert_19mayRIn\"","eventtime_from":"03/21/2023 10:06:10","eventtime_to":"03/25/2023 10:06:10","tz":"UTC","prettyJson":true,"max":1000,"queryId":"spotterwebservicee8904c76-b230-4ad7-990f-eefd220a22b8"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `totalDocuments` | number | Output field: totalDocuments | | `events` | array | Output field: events | | `events.timeline_by_month` | string | Output field: events.timeline\_by\_month | | `events.rg_timezoneoffset` | string | Output field: events.rg\_timezoneoffset | | `events.resourcegroupname` | string | Name of the resource | | `events.eventid` | string | Unique identifier | | `events.ipaddress` | string | Output field: events.ipaddress | | `events.week` | string | Output field: events.week | | `events.year` | string | Output field: events.year | | `events.accountresourcekey` | string | Output field: events.accountresourcekey | | `events.resourcehostname` | string | Name of the resource | | `events.sourceprocessname` | string | Name of the resource | | `events.rg_functionality` | string | Output field: events.rg\_functionality | | `events.userid` | string | Unique identifier | | `events.customfield2` | string | Output field: events.customfield2 | | `events.dayofmonth` | string | Output field: events.dayofmonth | | `events.jobid` | string | Unique identifier | | `events.resourcegroupid` | string | Unique identifier | | `events.datetime` | string | Time value | | `events.timeline_by_hour` | string | Output field: events.timeline\_by\_hour | | `events.collectiontimestamp` | string | Output field: events.collectiontimestamp | | `events.hour` | string | Output field: events.hour | | `events.accountname` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 25 Jan 2024 00:34:27 GMT","Content-Type":"text/plain","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","Cache-Control":"private, no-store, no-cache, must-revalidate","X-FRAME-OPTIONS":"DENY","Pragma":"no-cache","X-XSS-Protection":"1 ;mode=block","X-Content-Type-Options":"nosniff","Content-Security-Policy":"frame-ancestors 'self' *.securonix.net; default-src 'self' *.secur...` ## Get Top Threats Get top threats in the specified time period and count of violators for each threat using parameters like dateunit, dateunitvalue, offset, and max. ### Endpoint - **URL:** `Snypr/ws/sccWidget/getTopThreats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.dateunit` | string | Required | Parameters for the Get Top Threats action | | `parameters.dateunitvalue` | number | Required | Parameters for the Get Top Threats action | | `parameters.offset` | number | Required | Parameters for the Get Top Threats action | | `parameters.max` | number | Required | Parameters for the Get Top Threats action | ### Input Example `{"parameters":{"dateunit":"days","dateunitvalue":90,"offset":0,"max":10}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Response` | object | Output field: Response | | `Response.Date range` | array | Output field: Response.Date range | | `Response.Total records` | number | Output field: Response.Total records | | `Response.Docs` | array | Output field: Response.Docs | | `Response.Docs.Threat model id` | number | Unique identifier | | `Response.Docs.Threat nodel name` | string | Name of the resource | | `Response.Docs.Description` | string | Output field: Response.Docs.Description | | `Response.Docs.Criticality` | string | Output field: Response.Docs.Criticality | | `Response.Docs.No of violator` | number | Output field: Response.Docs.No of violator | | `Response.Docs.Generation time` | number | Time value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 25 Jan 2024 00:34:04 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","Cache-Control":"private, no-store, no-cache, must-revalidate","X-FRAME-OPTIONS":"DENY","Pragma":"no-cache","X-XSS-Protection":"1 ;mode=block","X-Content-Type-Options":"nosniff","Content-Security-Policy":"frame-ancestors 'self' *.securonix.net; default-src 'self' *...` ## Get Top Violations Retrieve top violations within a specified time period and count of violators for each violation in Securonix SNYPR. Requires parameters like dateunit, dateunitvalue, offset, and max. ### Endpoint - **URL:** `Snypr/ws/sccWidget/getTopViolations` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.dateunit` | string | Required | Parameters for the Get Top Violations action | | `parameters.dateunitvalue` | number | Required | Parameters for the Get Top Violations action | | `parameters.offset` | number | Required | Parameters for the Get Top Violations action | | `parameters.max` | number | Required | Parameters for the Get Top Violations action | ### Input Example `{"parameters":{"dateunit":"days","dateunitvalue":90,"offset":0,"max":10}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Response` | object | Output field: Response | | `Response.Date range` | array | Output field: Response.Date range | | `Response.Total records` | number | Output field: Response.Total records | | `Response.Docs` | array | Output field: Response.Docs | | `Response.Docs.Policy id` | number | Unique identifier | | `Response.Docs.Policy name` | string | Name of the resource | | `Response.Docs.Criticality` | string | Output field: Response.Docs.Criticality | | `Response.Docs.Violation entity` | string | Output field: Response.Docs.Violation entity | | `Response.Docs.Policy category` | string | Output field: Response.Docs.Policy category | | `Response.Docs.Threat indicator` | string | Output field: Response.Docs.Threat indicator | | `Response.Docs.Generation time` | number | Time value | | `Response.Docs.No of violator` | number | Output field: Response.Docs.No of violator | | `Response.Docs.Description` | string | Output field: Response.Docs.Description | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 25 Jan 2024 00:33:45 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","Cache-Control":"private, no-store, no-cache, must-revalidate","X-FRAME-OPTIONS":"DENY","Pragma":"no-cache","X-XSS-Protection":"1 ;mode=block","X-Content-Type-Options":"nosniff","Content-Security-Policy":"frame-ancestors 'self' *.securonix.net; default-src 'self' *...` ## Get Top Violators Get top violators within a specified time period and retrieve the risk score for each violator in Securonix SNYPR. Requires parameters like dateunit, dateunitvalue, offset, and max. ### Endpoint - **URL:** `Snypr/ws/sccWidget/getTopViolators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.dateunit` | string | Required | Parameters for the Get Top Violators action | | `parameters.dateunitvalue` | number | Required | Parameters for the Get Top Violators action | | `parameters.offset` | number | Required | Parameters for the Get Top Violators action | | `parameters.max` | number | Required | Parameters for the Get Top Violators action | ### Input Example `{"parameters":{"dateunit":"days","dateunitvalue":90,"offset":0,"max":10}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Response` | object | Output field: Response | | `Response.Date range` | array | Output field: Response.Date range | | `Response.Total records` | number | Output field: Response.Total records | | `Response.Docs` | array | Output field: Response.Docs | | `Response.Docs.Name` | string | Name of the resource | | `Response.Docs.Violator entity` | string | Output field: Response.Docs.Violator entity | | `Response.Docs.Risk score` | number | Score value | | `Response.Docs.Generation time` | number | Time value | | `Response.Docs.Department` | string | Output field: Response.Docs.Department | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 25 Jan 2024 00:33:27 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","Cache-Control":"private, no-store, no-cache, must-revalidate","X-FRAME-OPTIONS":"DENY","Pragma":"no-cache","X-XSS-Protection":"1 ;mode=block","X-Content-Type-Options":"nosniff","Content-Security-Policy":"frame-ancestors 'self' *.securonix.net; default-src 'self' *...` ## List All Policies Retrieve a list of all policies configured in Securonix SNYPR to detect violators, violations, and threats. The response includes every policy available in the system. ### Endpoint - **URL:** `Snypr/ws/policy/getAllPolicies` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `policies` | object | Output field: policies | | `policies.policy` | array | Output field: policies.policy | | `policies.policy.createdBy` | string | Output field: policies.policy.createdBy | | `policies.policy.createdOn` | string | Output field: policies.policy.createdOn | | `policies.policy.criticality` | string | Output field: policies.policy.criticality | | `policies.policy.description` | string | Output field: policies.policy.description | | `policies.policy.hql` | object | Output field: policies.policy.hql | | `policies.policy.id` | string | Unique identifier | | `policies.policy.name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 25 Jan 2024 00:32:56 GMT","Content-Type":"application/xml","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","Cache-Control":"private, no-store, no-cache, must-revalidate","X-FRAME-OPTIONS":"DENY","Pragma":"no-cache","X-XSS-Protection":"1 ;mode=block","X-Content-Type-Options":"nosniff","Content-Security-Policy":"frame-ancestors 'self' *.securonix.net; default-src 'self' *....` ## List All Users List all users in the user collection of Securonix SNYPR. ### Endpoint - **URL:** `Snypr/ws/spotter/index/search?query=index=users` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `totalDocuments` | number | Output field: totalDocuments | | `events` | array | Output field: events | | `events.country` | string | Output field: events.country | | `events.userriskscore` | string | Score value | | `events.firstname` | string | Name of the resource | | `events.employeetype` | string | Type of the resource | | `events.manageremployeeid` | string | Unique identifier | | `events.masked` | string | Output field: events.masked | | `events.usertimezoneoffset` | string | Output field: events.usertimezoneoffset | | `events.createdate` | string | Date value | | `events.title` | string | Output field: events.title | | `events.employeeid` | string | Unique identifier | | `events.userid` | string | Unique identifier | | `events.lastname` | string | Name of the resource | | `events.division` | string | Output field: events.division | | `events.tenantid` | string | Unique identifier | | `events.usercriticality` | string | Output field: events.usercriticality | | `events.managerlastname` | string | Name of the resource | | `events.workemail` | string | Output field: events.workemail | | `events.tenantname` | string | Name of the resource | | `events.location` | string | Output field: events.location | | `events.fullname` | string | Name of the resource | | `events.department` | string | Output field: events.department | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 25 Jan 2024 00:29:53 GMT","Content-Type":"text/plain","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=31536000 ; includeSubDomains","Cache-Control":"private, no-store, no-cache, must-revalidate","X-FRAME-OPTIONS":"DENY","Pragma":"no-cache","X-XSS-Protection":"1 ;mode=block","X-Content-Type-Options":"nosniff","Content-Security-Policy":"frame-ancestors 'self' *.securonix.net; default-src 'self' *.secur...` ## Retrieve List of Incidents Retrieve a list of incidents from Securonix SNYPR using specified parameters such as type, date range, and range type. Requires parameters and headers for execution. ### Endpoint - **URL:** `Snypr/ws/incident/get` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.type` | string | Required | Enter the type as list. | | `parameters.from` | string | Required | Enter the start time (EPOCH) in ms. | | `parameters.to` | string | Required | Enter the end time in ms. | | `parameters.offset` | number | Optional | This parameter is optional and used for pagination. | | `parameters.status` | string | Optional | Enter the status of the incident. This parameter is optional. | | `parameters.rangeType` | string | Required | Parameters for the Retrieve List of Incidents action | | `parameters.allowChildCases` | boolean | Optional | Enter true to receive the list of child cases associated with a parent case in the response. Otherwise, enter false. This parameter is optional. | | `parameters.max` | number | Optional | Enter the maximum number of records the API will display. This is a numeral value and it is optional. | | `parameters.sort` | string | Optional | Parameters for the Retrieve List of Incidents action | | `parameters.order` | string | Optional | Parameters for the Retrieve List of Incidents action | | `parameters.tenantname` | string | Optional | The name of the tenant from where the incidents will be retrieved. | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept` | string | Required | HTTP headers for the request | ### Input Example `{"parameters":{"type":"list","from":"1559161800000","to":"1559806119000","offset":0,"status":"Open","rangeType":"opened","allowChildCases":true,"max":100,"sort":"desc","order":"desc","tenantname":"Securonix_tenant_name"},"headers":{"Accept":"application/vnd.snypr.app-v3.0+json"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `result` | object | Result of the operation | | `result.data` | object | Response data | | `result.data.totalIncidents` | number | Response data | | `result.data.incidentItems` | array | Response data | | `result.data.incidentItems.violatorText` | string | Response data | | `result.data.incidentItems.lastUpdateDate` | number | Response data | | `result.data.incidentItems.violatorId` | string | Response data | | `result.data.incidentItems.incidentType` | string | Response data | | `result.data.incidentItems.incidentId` | string | Response data | | `result.data.incidentItems.incidentStatus` | string | Response data | | `result.data.incidentItems.riskscore` | number | Response data | | `result.data.incidentItems.assignedUser` | string | Response data | | `result.data.incidentItems.priority` | string | Response data | | `result.data.incidentItems.reason` | array | Response data | | `result.data.incidentItems.violatorSubText` | string | Response data | | `result.data.incidentItems.entity` | string | Response data | | `result.data.incidentItems.workflowName` | string | Response data | | `result.data.incidentItems.url` | string | Response data | | `result.data.incidentItems.isWhitelisted` | boolean | Response data | | `result.data.incidentItems.watchlisted` | boolean | Response data | | `result.data.incidentItems.tenantInfo` | object | Response data | | `result.data.incidentItems.tenantInfo.tenantid` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 19 Feb 2023 20:37:23 GMT"},"reason":"OK","json_body":{"status":"OK","result":{"data":{}}}}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | private, no-store, no-cache, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | content-length | The length of the response body in bytes | 140 | | Content-Security-Policy | HTTP response header: Content-Security-Policy | frame-ancestors 'self' \*.securonix.net; default-src 'self' \*.securonix.net; object-src 'self' \*.securonix.net data: blob:; script-src 'unsafe-inline' 'unsafe-eval' 'self' \*.securonix.net [https://edge.fullstory.com](https://edge.fullstory.com) [https://rs.fullstory.com](https://rs.fullstory.com) [http://iph.zoominsoftware.io/widget.js](http://iph.zoominsoftware.io/widget.js) data: blob:; style-src 'self' \*.securonix.net [https://fonts.googleapis.com](https://fonts.googleapis.com) 'unsafe-inline'; font-src 'self' \*.securonix.net [https://fonts.gstatic.com](https://fonts.gstatic.com) 'unsafe-inline'; connect-src 'self' \*.securonix.net [https://edge.fullstory.com](https://edge.fullstory.com) [https://rs.fullstory.com](https://rs.fullstory.com) [https://securonix-be-prod.zoominsoftware.io](https://securonix-be-prod.zoominsoftware.io) [http://documentation-be.securonix.com](http://documentation-be.securonix.com) wss\://saaspoc5t16expo.securonix.net:443 data: blob:; img-src 'self' \*.securonix.net [https://rs.fullstory.com](https://rs.fullstory.com) data: https:; child-src 'self' \*.securonix.net blob:; | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 25 Jan 2024 00:34:27 GMT | | Pragma | HTTP response header: Pragma | no-cache | | Set-Cookie | HTTP response header: Set-Cookie | JSESSIONID=610ACE2E3BABF8B2A161B50770A84799; Path=/Snypr; Secure; HttpOnly | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 ; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-FRAME-OPTIONS | HTTP response header: X-FRAME-OPTIONS | DENY | | X-XSS-Protection | HTTP response header: X-XSS-Protection | 1 ;mode=block |