Imports SIEM/XDR alerts, cases, assets, detection rules and events from the Sekoia API.
For the general flow of adding a source, see Connect Data Sources.
Sekoia.io account with read access to security data
Active Sekoia API key with read scopes: Alerts, Cases, Assets, Rules Catalog, Events search
Valid API URL (default: https://api.sekoia.io)
Sekoia console → Settings → Workspace → API Keys → + API key
Create a dedicated HARVEN API key with the read permissions listed above
Copy the API key — it is displayed only once
Base URL: https://api.sekoia.io (unless dedicated instance)
Paste the key into the API Key field
Click Save. HARVEN does not test the credentials on save: the connector opens on its Tables tab, where each table is checked
Field | Where to find it |
|---|---|
Base URL | Default: https://api.sekoia.io |
API Key | Sekoia → Settings → Workspace → API Keys |
alerts — Detection alerts: Identification (alert_uuid, short_id, alert_title), Prioritization (status, urgency_value, severity), MITRE ATT&CK context (alert_type, tactic, technique), Handling and response times (assignee, time_to_detect_s, time_to_acknowledge_s, time_to_respond_s, time_to_resolve_s)
cases — Cases (incidents): Identification (case_uuid, short_id, title), Severity and scope (priority, status, alerts_count), Latency and MTTR (created_at, updated_at)
assets — Asset inventory: Identification (asset_uuid, name, asset_type), Criticality and hygiene (criticality, reviewed, os_type), EDR join key + coverage signal (primary_hostname, props), Telemetry: last report and event volume (last_seen, nb_events)
detection_rules — Detection rules (sigma): Identification (rule_uuid, name, rule_type), Detection coverage (severity, enabled, verified), Classification (alert_category, alert_type, source)
events — SIEM events (bounded time window — the last 24 hours unless you filter on event_timestamp): Event (event_id, event_type, event_timestamp), Network/user context (source_ip, destination_ip, user), Result and source (action, outcome, intake_name), Reporting host and agent; join key to assets (host_name, host_hostname, agent_id)
Need help? Contact [email protected].
