Connect Sekoia.io

Imports SIEM/XDR alerts, cases, assets, detection rules and events from the Sekoia API.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• Sekoia.io account with read access to security data

• Active Sekoia API key with read scopes: Alerts, Cases, Assets, Rules Catalog, Events search

• Valid API URL (default: https://api.sekoia.io)

Step 1 — Generate an API key

1. Sekoia console → API credentials section

2. Create a dedicated HARVEN API key

3. Copy the API key

Step 2 — Fill the parameters in HARVEN

1. Base URL: https://api.sekoia.io (unless dedicated instance)

2. Paste the key into the API Key field

3. Test the connection before saving

What to enter in HARVEN

• Base URL — Sekoia API URL (Default: https://api.sekoia.io)

• API Key — Sekoia API key (Sekoia → API credentials)

What HARVEN reads

• alerts — Detection alerts: identification (alert_uuid, short_id, alert_title), prioritization (status, urgency_value, severity), MITRE ATT&CK context (alert_type, tactic, technique)

• cases — Cases (incidents): identification (case_uuid, short_id, title), severity and scope (priority, status, alerts_count), latency and MTTR (created_at, updated_at)

• assets — Asset inventory: identification (asset_uuid, name, asset_type), criticality and hygiene (criticality, reviewed, os_type), EDR join key + coverage signal (primary_hostname, props)

• detection_rules — Detection rules (sigma): identification (rule_uuid, name, rule_type), detection coverage (severity, enabled, verified), classification (alert_category, alert_type, source)

• events — SIEM events (bounded time window): event (event_id, event_type, event_timestamp), network/user context (source_ip, destination_ip, user), result and source (action, outcome, intake_name)

Official documentation

• Sekoia.io documentation

• Sekoia.io API documentation

Need help? Contact [email protected].