Skip to main content

Lema

Visualize the third parties you manage in Lema, their risk assessments and their monitoring alerts. Map assessments and alerts to each vendor, and monitor vendor risk changes through queries and alerts.

Installation​

This integration connects to the Lema Public API (https://api.lema.ai) and ingests the third parties (vendors) you manage in Lema, their risk assessments, and the monitoring alerts raised on them. Every request is a read-only GET. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

Prerequisites​

  • A Lema organization with your third-party inventory.
  • A Lema Public API key for that organization.
  • Access to JupiterOne with permission to configure integrations.

Configuration in Lema​

The integration authenticates with a Lema Public API key, sent as Authorization: Bearer <key> on every request. The key grants read access to your organization's third parties, assessments and monitoring signals, so treat it as a credential.

API keys and their permissions are managed on the Lema side. Ask your Lema administrator or your Lema contact for a Public API key with read access to:

  • Third parties (GET /api/v1/third-parties)
  • Assessments (GET /api/v1/assessments)
  • Signals (GET /api/v1/signals)

Copy the key and store it somewhere safe; you will paste it into JupiterOne.

Configuration in JupiterOne​

To install the Lema integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Lema. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Lema account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • The API Key authentication fields below.

Authentication fields​

FieldRequiredDescription
API KeyYesThe Lema Public API key. It is sent as Authorization: Bearer <key>.
API Base URLNoThe Lema API host. Defaults to https://api.lema.ai. Only https Lema hosts are accepted.

When you save the instance, JupiterOne checks the key by requesting one third party from the Lema API. An invalid or revoked key is reported as an authentication error.

Click Create once all values are provided to finalize the integration.

Data Sources​

Each data source can be enabled or disabled on its own. All data sources are disabled by default, so enable the ones you want to ingest. The lema_account entity is always created.

Data SourceDescriptionEntities Created
VendorsThird parties managed in Lema, with lifecycle (in evaluation, onboarded, unsanctioned, archived, offboarded), approval status, assessment score, inherent risk level, tags, linked sources, assessment counts and re-assessment due date.lema_vendor
AssessmentsFinalized and ongoing third-party risk assessments, with status, decision, score, inherent risk level, project, assessors, control counts by verification status, and start, completion and due dates.lema_assessment
AlertsContinuous-monitoring signals that a Lema alert rule promoted to an alert, with severity, status, type, alert rule, linked control, CVE identifier and references.lema_alert
caution

Assessments and Alerts require Vendors. Both run after the Vendors data source and attach to the vendor they belong to. If Vendors is disabled, Assessments and Alerts are not ingested either. To ingest everything the integration supports, enable all three data sources.

Relationships are built only when every data source they need is enabled:

RelationshipRequires
lema_account HAS lema_vendorVendors
lema_vendor HAS lema_assessmentVendors and Assessments
lema_vendor HAS lema_alertVendors and Alerts

Example queries​

Find onboarded vendors with no completed assessment:

FIND lema_vendor WITH lifecycle = 'onboarded'
  THAT !HAS lema_assessment WITH status = 'completed'

Find unsanctioned third parties:

FIND lema_vendor WITH lifecycle = 'unsanctioned'

Find onboarded vendors with an open critical alert:

FIND lema_vendor WITH lifecycle = 'onboarded'
  THAT HAS lema_alert WITH severity = 'critical' AND open = true

Find vendors whose re-assessment is overdue:

FIND lema_vendor WITH reAssessmentDueOn < date.now

Notes​

  • Every run is a full sync. Each run reads every third party, assessment and alert. Items that Lema no longer returns are removed from the graph on the next run.
  • Only alerts are ingested. Monitoring signals that no alert rule promoted to an alert are not collected. Signals Lema marks as false positives are excluded by the Lema API.
  • Contact details are not ingested. Third-party contacts and business-owner names and e-mail addresses are not stored in JupiterOne. Assessments carry the names of their assessors and assignees, not their e-mail addresses.
  • Alert counts per vendor come from the related lema_alert entities, so they can be filtered by severity and status in queries.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Additional resources​

  • Lema — for API keys and API access questions, contact your Lema team