Skip to main content

Cyberhaven

Visualize Cyberhaven Endpoints and monitor changes through queries and alerts.

Installation​

Requirements​

  • A Cyberhaven role carrying the endpoint__read permission, and an API key assigned to that role.
  • Appropriate permissions in JupiterOne to setup new integration.

Configuration in Cyberhaven​

Authentication​

Cyberhaven uses token-based authentication to secure its API endpoints. To authenticate, you must first create an API key in the Cyberhaven Console and use it to generate a temporary bearer token. JupiterOne performs this exchange for you; you only supply the API key.

Note: Create the role before generating the key. The role attached to the key must carry the endpoint__read permission, otherwise Cyberhaven rejects the request.

Refer to the Cyberhaven documentation for guidance on creating an API role: Creating an API Role

Generate an API Key​
  1. Navigate to Preferences > Users and API keys, then open the API Keys tab.
  2. Click New API Key.
  3. Provide a name to identify the API key.
  4. Select a role from the list. The role must include the endpoint__read permission.
  5. Specify a validity period (up to one year).
  6. Click Save.
  7. Copy and securely store the generated API key.

Configuration in JupiterOne​

  1. From the JupiterOne Search homepage, navigate to Integrations from the top menu.
  2. Search for Cyberhaven, then select it.
  3. Click Add Instance, then provide the following information:
  • Cyberhaven API Key: Use the key generated in the Generate an API Key section.
  • Cyberhaven Tenant Name: Your tenant's subdomain only — not the full console URL. If you sign in at https://acme.cyberhaven.io, enter acme.
  • Account Name: A label for identifying this Cyberhaven instance in JupiterOne. If Tag with Account Name is enabled, this value is stored in tag.AccountName for all ingested entities.
  • Description: (Optional) A brief description to help your team identify this integration.
  • Polling Interval: Choose an appropriate interval for your monitoring needs. You can also select DISABLED to manually execute the integration.
  1. Once all values are entered, click Create Instance.

Next Steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.