Sysdig
Visualize Sysdig account, teams, and users, and monitor changes through queries and alerts.
- Installation
- Authorization
- Data Model
- Types
- Release Notes
Installation
To use the Sysdig integration, you need a Sysdig API token and your account region. The token must belong to a user with Administrator privileges so the integration can enumerate all users, teams, agents, and cluster data across the organization.
Prerequisites
- Obtain your API Token from Sysdig: log in to Sysdig Monitor or Sysdig Secure, go to Settings > User Profile, and copy the token shown. See Retrieve the Sysdig API Token for details.
- Confirm your Region code. This is the short identifier for your Sysdig SaaS endpoint, such as
us2oreu1. See SaaS Regions and IP Ranges for the full list.
Configuration in JupiterOne
Navigate to Integrations in JupiterOne, select Sysdig, and click New Instance.
Creating an instance requires the following:
- API Token — Your Sysdig account API token.
- Region — Your Sysdig SaaS region code (for example,
us2).
Click Create to finish. The integration will begin running on the polling interval you selected, or you can trigger it manually at any time.
Next steps
Once configured, your Sysdig data will populate in JupiterOne. See the Instance management guide to learn how to edit, disable, or re-run your integration instance.
Entities
The following entities are created:
| Resources | Entity _type | Entity _class |
|---|---|---|
| Account | sysdig_account | Account |
| Agent | sysdig_agent | Scanner |
| Cluster | sysdig_cluster | Cluster |
| Finding | sysdig_finding | Finding |
| Finding | sysdig_finding | Finding, Vulnerability |
| Image Scan | sysdig_image_scan | Assessment |
| Scanner | sysdig_scanner | Service |
| Team | sysdig_team | Team |
| User | sysdig_user | User |
Relationships
The following relationships are created:
Source Entity _type | Relationship _class | Target Entity _type |
|---|---|---|
sysdig_account | HAS | sysdig_user |
sysdig_account | HAS | sysdig_team |
sysdig_account | HAS | sysdig_image_scan |
sysdig_account | HAS | sysdig_scanner |
sysdig_account | HAS | sysdig_cluster |
sysdig_account | HAS | sysdig_agent |
sysdig_agent | SCANS | sysdig_cluster |
sysdig_image_scan | IDENTIFIED | sysdig_finding |
sysdig_scanner | PERFORMED | sysdig_image_scan |
sysdig_team | HAS | sysdig_user |
Mapped Relationships
The following mapped relationships are created:
Source Entity _type | Relationship _class | Target Entity _type | Direction |
|---|---|---|---|
sysdig_finding | IS | cve | FORWARD |
Sysdig Finding
sysdig_finding inherits from Finding
Sysdig Finding
sysdig_finding inherits from Finding, Vulnerability
Sysdig User
sysdig_user inherits from User
| Property | Type | Description | Specifications |
|---|---|---|---|
admin | boolean | ||
enabled | boolean | ||
lastSeenOnSecure | integer | ||
products | array of strings | ||
systemRole | string | ||
version | integer |
Release Notes
- 2025-06-05 — Promoted Sysdig finding entities to carry both the Vulnerability and Finding entity classes, enabling broader vulnerability query compatibility.