Skip to main content

Tidal Cyber

Bring your Tidal Cyber threat-informed defense posture into JupiterOne: the defensive stacks you model in Tidal, the security products and capabilities in each stack, your threat profiles, and the coverage maps that score a stack against a threat profile. Query which products and capabilities cover your prioritized threats alongside the rest of your asset graph.

Installation​

This integration connects to the Tidal Cyber Enterprise API of your tenant (https://<tenant>-hosted-api.tidalcyber.com) and ingests your defensive stacks, the products and capabilities in them, your threat profiles and your coverage maps. It authenticates with a Tidal API token, sent in the Authorization: Token <token> header, and only reads data. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

The integration ingests your tenant's own posture data. It does not ingest the MITRE ATT&CK knowledge base (techniques, groups, software, campaigns) that Tidal also serves, because that content is the same for every tenant.

Prerequisites​

  • A Tidal Cyber Enterprise tenant.
  • A Tidal admin who can turn on API access for the tenant.
  • A Tidal user account to own the API token. We recommend a dedicated service account, because a token stops working when the user who created it is deactivated.
  • Access to JupiterOne with permission to configure integrations.

Configuration in Tidal Cyber​

Turn on API access​

  1. Sign in to your Tidal tenant as an admin.
  2. Open the user menu in the upper-right corner and select API Token Management.
  3. Make sure the API Access Enabled toggle is on.

If the Generate New Token button is not visible, you are not an admin and API access is turned off for the tenant. Ask a Tidal admin to turn it on.

Create the API token​

  1. Sign in to Tidal as the user that will own the token.
  2. Open the user menu and select API Token Management.
  3. Click Generate New Token and give the token a description, such as JupiterOne.
  4. Choose Read Only. The integration never changes data in Tidal.
  5. Create the token, copy it and store it somewhere safe. Tidal shows the token value only once.

Tidal API tokens are valid for one year. Create a new token and update the instance before the token expires, or ingestion stops. You can see the expiration date in API Token Management.

Find your tenant name​

The tenant name is the first part of the address you use to sign in to Tidal. If you sign in at https://example.tidalcyber.com, the tenant name is example.

Configuration in JupiterOne​

To install the Tidal Cyber integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Tidal Cyber. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Tidal Cyber account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • The Authentication fields below.

Authentication fields​

FieldRequiredDescription
TenantYesYour Tidal tenant name, for example example for https://example.tidalcyber.com. A full Tidal address is also accepted.
API TokenYesThe Tidal API token created above. A Read Only token is enough. It is masked in JupiterOne.

When you save the instance, JupiterOne checks that the tenant name is valid and calls the Tidal API with the token. A wrong tenant, an expired or revoked token, or API access turned off for the tenant fails the check.

Click Create once all values are provided to finalize the integration.

Data Sources​

All data sources are disabled by default, so a new instance ingests only the tidal_account entity until you enable the ones you want. To enable them, open the instance, turn on the data sources under Data Sources, and save. They are ingested on the next run.

Data SourceDescriptionEntities Created
Defensive PostureDefensive stacks, the security products placed in each stack with their vendor, the product capabilities in each stack and whether they are enabled, threat profiles, and the coverage maps that score a stack against a threat profile.tidal_defensive_stack, tidal_product, tidal_capability, tidal_threat_profile, tidal_coverage_map
UsersThe Tidal user that owns the API token.tidal_user

Relationships are built only when the data source they need is enabled:

RelationshipRequires
tidal_account HAS tidal_defensive_stackDefensive Posture
tidal_defensive_stack HAS tidal_productDefensive Posture
tidal_product HAS tidal_capabilityDefensive Posture
tidal_coverage_map EVALUATES tidal_defensive_stackDefensive Posture
tidal_coverage_map USES tidal_threat_profileDefensive Posture
tidal_account HAS tidal_userUsers

Notes​

  • One entity per product per stack. A product placed in two defensive stacks becomes two tidal_product entities, one under each stack, because each stack has its own capability settings. productId holds the Tidal product-registry id, so you can group them in a query.
  • Every run is a full sync. Stacks, products, capabilities, threat profiles and coverage maps that Tidal no longer reports are removed from the graph on the next run.
  • Raw data is not stored. Entities keep only the mapped properties.

Rate limits​

The Tidal API allows 2,000 requests per 5 minutes per tenant. A run makes a handful of requests plus one per distinct product in your stacks, so it stays far below that limit. If Tidal returns a rate-limit error, the integration waits and retries.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Additional resources​