Connector Setup Guide

Step-by-step instructions for configuring each connector type.

Overview

Connectors enable Triage Warden to:

• Ingest alerts from SIEMs and security tools
• Enrich incidents with threat intelligence
• Execute actions like creating tickets or isolating hosts
• Send notifications to communication platforms

Adding a Connector

1. Navigate to Settings → Connectors
2. Click Add Connector
3. Select connector type
4. Fill in the required fields
5. Click Test Connection to verify
6. Click Save

Threat Intelligence Connectors

VirusTotal

Enriches file hashes, URLs, IPs, and domains with reputation data.

Prerequisites:

• VirusTotal account (free or premium)
• API key from virustotal.com/gui/my-apikey

Configuration:

Rate Limits:

• Free tier: 4 requests/minute
• Premium: 500+ requests/minute

Verify It Works:

1. Create a test incident with a known-bad hash
2. Check incident enrichments for VirusTotal data

AlienVault OTX

Open threat intelligence from AlienVault.

Prerequisites:

• OTX account at otx.alienvault.com
• API key from Settings → API Keys

Configuration:

SIEM Connectors

Splunk

Ingest alerts from Splunk and run queries.

Prerequisites:

• Splunk Enterprise or Cloud
• HTTP Event Collector (HEC) token
• User with search capabilities

Configuration:

Setting Up Webhooks:

1. In Splunk, create an alert action that sends to webhook
2. Configure webhook URL: https://triage.company.com/api/webhooks/splunk
3. Set webhook secret in Triage Warden connector config

Elastic Security

Connect to Elastic Security for SIEM alerts.

Prerequisites:

• Elasticsearch 7.x or 8.x
• User with read access to security indices

Configuration:

Microsoft Sentinel

Azure Sentinel integration for cloud SIEM.

Prerequisites:

• Azure subscription with Sentinel workspace
• App registration with Log Analytics Reader role

Configuration:

Azure Setup:

1. Create App Registration in Azure AD
2. Grant Log Analytics Reader role on Sentinel workspace
3. Create client secret
4. Copy IDs and secret to Triage Warden

EDR Connectors

CrowdStrike Falcon

Endpoint detection and host isolation.

Prerequisites:

• CrowdStrike Falcon subscription
• API client with appropriate scopes

Configuration:

Required API Scopes:

• Detections: Read
• Hosts: Read, Write (for isolation)
• Incidents: Read

CrowdStrike Setup:

1. Go to Support → API Clients and Keys
2. Create new API client
3. Select required scopes
4. Copy Client ID and Secret

Microsoft Defender for Endpoint

MDE integration for alerts and host actions.

Prerequisites:

• Microsoft 365 E5 or Defender for Endpoint license
• App registration with Defender API permissions

Configuration:

Required API Permissions:

• Alert.Read.All
• Machine.Read.All
• Machine.Isolate (for isolation actions)

SentinelOne

SentinelOne EDR integration.

Prerequisites:

• SentinelOne console access
• API token with appropriate permissions

Configuration:

Ticketing Connectors

Jira

Create and manage security tickets.

Prerequisites:

• Jira Cloud or Server instance
• API token (Cloud) or password (Server)

Configuration:

Jira Cloud Setup:

1. Go to id.atlassian.com/manage-profile/security/api-tokens
2. Create API token
3. Use your email as username

Jira Server Setup:

• Use password instead of API token
• Ensure user has project access

ServiceNow

ServiceNow ITSM integration.

Prerequisites:

• ServiceNow instance
• User with incident table access

Configuration:

Identity Connectors

Microsoft 365 / Azure AD

User management and sign-in data.

Prerequisites:

• Azure AD with appropriate licenses
• App registration with Graph API permissions

Configuration:

Required API Permissions:

• User.Read.All
• AuditLog.Read.All
• User.RevokeSessions.All (for user disable)

Google Workspace

Google Workspace user management.

Prerequisites:

• Google Workspace admin access
• Service account with domain-wide delegation

Configuration:

Google Setup:

1. Create service account in Google Cloud Console
2. Enable domain-wide delegation
3. Add required OAuth scopes in Google Admin
4. Download JSON key file

Testing Connectors

After configuration, always test:

1. Click Test Connection in connector settings
2. Check the response for success/errors
3. For ingestion connectors, verify sample data appears

Common Issues

Connector Health

Monitor connector health at Settings → Connectors or via API:

curl http://localhost:8080/health/detailed | jq '.components.connectors'

Healthy connectors show status connected. Troubleshoot any showing error or disconnected.