Skip to main content

Spektion

Bring the devices and vulnerabilities that Spektion observes through runtime telemetry into the JupiterOne graph. The integration ingests every device running the Spektion sensor as a Host, with its hostname, IP address, operating system, sensor version, online state and last-seen date, so it unifies with the same device from your other endpoint and inventory tools. It also ingests the CVEs present in your organization as vulnerability findings, enriched with CVSS, EPSS, CISA KEV, exploit maturity, SLA status and the Spektion runtime risk score, and links each one to the devices it affects along with the affected software versions. Filter findings by severity, KEV, SLA status, exploit maturity and EPSS range, then use them in the JupiterOne vulnerability views, queries and alerts alongside the rest of your environment.

Installation​

This integration connects to the Spektion Public API (https://api.spektion.com/v1) and ingests the devices the Spektion sensor reports on (assets) and the CVEs present in your organization (vulnerability findings). Every request is a read-only GET. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

Prerequisites​

  • A Spektion organization with the Spektion sensor deployed to your devices.
  • A Spektion administrator account, to create an API key in the Admin Console.
  • Access to JupiterOne with permission to configure integrations.

Configuration in Spektion​

The integration authenticates with a Spektion Public API key, sent as Authorization: Bearer <key> on every request. An API key grants read access to your organization's security data, so treat it as a credential.

Create the API key​

  1. Sign in to the Spektion console as an administrator.
  2. Open the Admin Console (gear icon, top right), then go to Connect > API Keys.
  3. Create a key, give it a descriptive name such as JupiterOne, and set an expiration date.
  4. Copy the key right away and store it somewhere safe. It is shown only once, and you will paste it into JupiterOne.

Spektion recommends one key per integration. Note the expiration date: when the key expires, the integration stops ingesting until you add a new key to the instance.

Configuration in JupiterOne​

To install the Spektion integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Spektion. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Spektion account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • The Authentication field below.

Authentication fields​

FieldRequiredDescription
API KeyYesThe Spektion Public API key created above. It is sent as Authorization: Bearer <key>.

When you save the instance, JupiterOne checks the key by requesting one asset from the Spektion API. An invalid or expired key is reported as an authentication error.

Vulnerability Filters​

All filters are optional and apply only to vulnerability findings. They are sent to the Spektion API, so findings outside the filters are never read and do not count against the API rate limit. Leave them empty to ingest every CVE in your organization. Assets are not filtered.

FieldDefaultDescription
SeveritiesEmpty (all severities)Ingest only findings with these severities. Options are Critical, High, Medium, Low, Informational and Unknown.
CISA KEV onlyOffIngest only CVEs in the CISA Known Exploited Vulnerabilities catalog. When off, KEV and non-KEV CVEs are both ingested.
SLA StatusesEmpty (all SLA statuses)Ingest only findings with these SLA statuses, as computed from your Spektion SLA policy. Options are Overdue, Due today, Due soon and On track.
Exploit MaturityEmpty (all exploit maturities)Ingest only findings at exactly this exploit maturity. Options are None (no known exploit data), Proof of concept, Weaponized PoC and Exploited in the wild.
EPSS MinimumEmpty (0)Inclusive lower bound on the EPSS score. Options are 0, 0.01, 0.05, 0.1, 0.2, 0.3, 0.5, 0.7, 0.9 and 1.
EPSS MaximumEmpty (1)Inclusive upper bound on the EPSS score, with the same options as EPSS Minimum.

EPSS Minimum must be less than or equal to EPSS Maximum: an instance with a minimum greater than the maximum is rejected when you save it.

Click Create once all values are provided to finalize the integration.

caution

Narrowing a filter later removes findings from JupiterOne. Findings that no longer match the Vulnerability Filters on the next run are deleted from the graph, together with their relationships to assets.

Data Sources​

Each data source can be enabled or disabled on its own. All data sources are disabled by default, so enable the ones you want to ingest. The spektion_account and spektion_service entities are always created.

Data SourceDescriptionEntities Created
AssetsDevices the Spektion sensor reports on, ingested for device unification, with their hostname, IP address, operating system, sensor version, online state and last-seen date.spektion_asset
Vulnerability FindingsCVEs present in the organization, limited by the Vulnerability Filters, with CVSS, EPSS, CISA KEV, exploit maturity, SLA status, the Spektion risk score and the affected software products and versions.spektion_finding

To ingest everything the integration supports, enable both Assets and Vulnerability Findings.

Each finding represents one CVE across your organization. The devices it affects are linked to it by relationships, so a CVE found on many devices is a single spektion_finding with one relationship per affected device.

Relationships are built only when every data source they need is enabled:

RelationshipRequires
spektion_account PROVIDES spektion_serviceAlways created
spektion_service IDENTIFIED spektion_findingVulnerability Findings
spektion_asset HAS spektion_finding (with the affected software version and first-seen date for that device)Assets and Vulnerability Findings
caution

Enable Assets together with Vulnerability Findings to link findings to devices. If Assets is disabled, findings are still ingested but no spektion_asset HAS spektion_finding relationships are created, so you cannot see which devices each CVE affects.

Device unification​

Spektion assets are ingested with the Device and Host classes and correlate with the same device from other integrations by hostname, IP address and FQDN only. When Spektion reports a fully qualified hostname, the short hostname and the FQDN are both stored. The Spektion API does not expose a serial number or MAC address, so these are not available for correlation.

Notes​

  • Every run is a full sync. Each run reads all assets and every finding that matches the filters. Assets and findings that Spektion no longer reports are removed from the graph on the next run.
  • Detections are not ingested yet. Spektion runtime risk detections and the activities feed are not collected. Findings carry the Spektion risk score and risk severity for each CVE.
  • Devices correlate by hostname, IP address and FQDN only. Spektion exposes no serial number or MAC address. See Device unification above.

Rate limits​

The Spektion API rate-limits requests per API key. The integration paces itself to a fixed rate of 5 requests per second across the whole run and, when Spektion answers with 429 Too Many Requests, waits for the time given in the Retry-After header before retrying. Besides listing assets and CVEs, the integration makes one request per ingested CVE to read its affected software, and, when Assets is enabled, one request per affected software product to find the devices it is installed on. In large environments, use the Vulnerability Filters to ingest the CVEs you act on so each run finishes sooner.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Additional resources​