Reco
Visualize changes to Reco Accounts, Users, Identity Users, Identity Accounts, Policies, Devices, Applications, and Alerts through queries and alerts.
- Installation
- Data Model
- Types
Reco Integration: Installation Guide
Overview
This guide helps you set up the Reco integration to ingest data into the JupiterOne platform.
Prerequisites
Before you begin, ensure you have the following:
- An active Reco account.
- Admin-level access to manage API keys in Reco.
- Access to the JupiterOne portal to create and manage integrations.
Configuration in Reco
Generate API Key in Reco
Reco uses API key-based authentication to authorize access to its APIs. Follow these steps to generate a key:
- Log in to your Reco portal.
- Navigate to Integrations.
- Navigate to API Access Keys
- Click Add API Access Key to generate a new key.
- Provide a descriptive name for the key and click Add.
- Copy and securely save the generated API key.
⚠️ Note: You won’t be able to view the full key again after navigating away from the page.
Once created, your key will appear with a status of active, indicating it's ready for use.
Configure Integration in JupiterOne
-
In JupiterOne, navigate to the Integrations section from the top navigation bar.
-
Search for and select Reco.
-
Click Add Instance and fill in the following fields:
- Reco API Key: Paste the API key generated in Reco.
- Reco Host: Enter your Reco server hostname (e.g.,
example.reco.ai). - Account Name: Provide a unique identifier for this Reco instance in JupiterOne.
- If the Tag with Account Name option is enabled, entities will include this value in
tag.AccountName.
- If the Tag with Account Name option is enabled, entities will include this value in
- Description: (Optional) Add a description to help your team identify this integration.
- Polling Interval: (Optional) Choose how frequently the integration should run. Leave as
DISABLEDfor manual execution.
-
Click Create Configuration to save the settings.
Next Steps
Your Reco integration instance will now execute according to the configured polling interval and begin ingesting data into JupiterOne.
To manage or update the integration, refer to the Instance Management Guide.
Entities
The following entities are created:
| Resources | Entity _type | Entity _class |
|---|---|---|
| Account User | reco_account_user | User |
| Alert | reco_alert | Finding |
| Application | reco_application | Application |
| Device | reco_device | Host |
| Policy | reco_policy | Policy |
| Reco Account | reco_account | Account |
| Reco Identity Account | reco_identity_account | Account |
| Reco Identity User | reco_identity_user | User |
Relationships
The following relationships are created:
Source Entity _type | Relationship _class | Target Entity _type |
|---|---|---|
reco_account | HAS | reco_account_user |
reco_identity_account | HAS | reco_application |
reco_identity_user | OWNS | reco_device |
reco_identity_user | HAS | reco_identity_account |
reco_policy | TRIGGERS | reco_alert |
Reco Account
reco_account inherits from Account
Reco Account User
reco_account_user inherits from User
| Property | Type | Description | Specifications |
|---|---|---|---|
isSingleSignOn | boolean | ||
lastLoggedInOn | number | ||
roles | array of strings | ||
ssoAppIds | array of strings |
Reco Alert
reco_alert inherits from Finding
| Property | Type | Description | Specifications |
|---|---|---|---|
extractionSource | string | ||
instanceId | string | ||
lastExtractedOn | number | ||
lastScannedOn | number | ||
tenantId | string | ||
totalComments | number |
Reco Application
reco_application inherits from Application
| Property | Type | Description | Specifications |
|---|---|---|---|
appCreatedAt | number | ||
appGroups | array of strings | ||
applicationInstances | array of strings | ||
applicationName | string | ||
appOwner | array of strings | ||
authorizationStatus | string | ||
authTypes | array of strings | ||
bkBreachIndex | number | ||
bkBreachIndexLastUpdatedOn | number | ||
bkCyberRating | number | ||
bkCyberRatingLastUpdatedOn | number | ||
bkGradeLetter | string | ||
bkRansomwareIndex | number | ||
bkRansomwareIndexLastUpdatedAt | number | ||
category | string | ||
companySize | string | ||
firstUsedOn | number | ||
isShadow | boolean | ||
isSsoEnabled | boolean | ||
lastThirtyDaysScore | number | ||
lastUsedOn | number | ||
logo | string | ||
numberOfUsers | number | ||
overrodeUsage | string | ||
securityScore | number | ||
securityScoreLetter | string | ||
securityScoreUrl | string | ||
tenantId | string | ||
typeUsage | string | ||
unusedApp | boolean | ||
usesAI | boolean | ||
vendor | string | ||
website | string |
Reco Device
reco_device inherits from Host
| Property | Type | Description | Specifications |
|---|---|---|---|
accountId | string | ||
hasIdentity | boolean | ||
instanceId | string | ||
isRegistered | boolean | ||
lastApiMessageId | string | ||
managementStatus | string |
Reco Identity Account
reco_identity_account inherits from Account
| Property | Type | Description | Specifications |
|---|---|---|---|
accountType | string | ||
adminLabel | string | ||
adminLabelUpdatedAt | number | ||
alerts30Days | number | ||
alertsCount | number | ||
deactivatedOn | number | ||
domainType | string | ||
email | string | ||
hasMfa | boolean | ||
instanceId | string | ||
isActive | boolean | ||
isAdmin | boolean | ||
isGuest | boolean | ||
isInternal | boolean | ||
isPrivileged | boolean | ||
isServiceAccount | boolean | ||
isStandard | boolean | ||
lastLoggedInOn | number | ||
lastSeenOn | number | ||
location | string | ||
locationAnalysis | array of strings | ||
numGroups | number | ||
permissions | array of strings | ||
permissionSets | array of strings | ||
photo | string | ||
relatedEmails | array of strings | ||
roles | array of strings | ||
tenantId | string | ||
userTypeDisplay | string | ||
workspaceId | string |
Reco Identity User
reco_identity_user inherits from User
| Property | Type | Description | Specifications |
|---|---|---|---|
alertsCount | number | ||
appInstanceIds | array of strings | ||
departments | array of strings | ||
hasAccess | boolean | ||
isFormerUser | boolean | ||
jobTitles | array of strings | ||
labelNames | array of strings | ||
lastLoginOn | number | ||
lastSeenOn | number | ||
relatedAccountCount | number |
Reco Policy
reco_policy inherits from Policy
| Property | Type | Description | Specifications |
|---|---|---|---|
openAlerts | number | ||
policyType | string | ||
riskLevel | string | ||
sources | array of strings | ||
status | string | ||
tags | array of strings | ||
totalAlerts | number |