Integrations

Integrations is where you connect providers and manage their connections. Open it from the sidebar or press g then n. You need the integration.read permission to see it, and both integration.manage and credential.manage to add a connection.

Connectors

"Response actions" are the changes Vigilbase can propose for that provider. Every action needs write access that you grant and an approved plan. "Read-only" connectors only collect data.

Providers with their own page have setup steps documented here. For the others, the connect wizard in the app lists the fields and permissions each one needs.

Add a connection

1. 1

   Choose Add connection, then Select a provider. Search by name if you need to.

2. 2

   Choose Connect. Providers marked One-click connect by signing in to the provider, launching a CloudFormation stack, running one command in Cloud Shell or following a guided setup in Google Admin. You can always switch to the manual path, for example Use an API token instead.

3. 3

   Choose Access. Read and write lets Vigilbase propose response actions. Read only means Vigilbase only reads; you can add write access later from the connection page.

4. 4

   Enter credentials if asked. Secret values are encrypted on receipt and never shown again, logged or sent to Vigil.

5. 5

   Validate, choose scopes and datasets. On the manual path the wizard runs Credentials, Validate, Scopes, Datasets and Done. Validation checks which scopes are granted and which datasets and actions are actually available.

When the connection is ready, collection starts for each selected scope. Health, lag and volume appear as data arrives.

Manage a connection

Open a connection from All connections to see its tabs: Overview, Data, Response actions, Setup & access and Activity.

• Needs attention lists anything wrong, worst first, with one fix per item.
• Collection jobs shows one job per dataset and scope with its last collection, records in the last 24 hours and retries. Collect now requests a collection for a polled job.
• Manage datasets changes what is collected. Check again re-checks credentials, scopes and dataset availability.
• The … menu offers Add write access, Remove write access, Reconnect and Disable connection.

A connection's status is one of Enabled, Delayed, Degraded, Authorisation required, Not collecting, Disabled, Licence required, Checking access or Setting up.

Disable or delete a connection

Disable connection stops collection, revokes credentials and marks coverage for dependent detections as disabled. Collected evidence stays under your retention policy. Once a connection is disabled you can choose Delete connection to remove it from Integrations. Deleting changes nothing in your provider account.

Private collectors

A private collector collects generic syslog from private networks and sends it to Vigilbase. Under Private collectors, choose New collector, give it a Name and choose Create enrollment token. Save the token straight away; it is short-lived and used once to enrol the collector. The list shows each collector's status, version, last heartbeat and buffer.