Coveo

Use Coveo data with Cortex XSIAM.

The capabilities and sub-capabilities listed for this connector are available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

This connector includes the following capabilities and sub-capabilities (if applicable):

• SaaS Posture Configuration Monitoring: Detect, monitor and alert on settings of your SaaS application.

  • saas-posture-config-remediation: Help remediate the misconfigured security settings of your SaaS application.

How to configure the Coveo connector

To access Couchbase, Cortex XSIAM requires the following information, which you will specify during the connection process.

• Admin API Key: A generated character string that identifies a Coveo administrator to the Coveo API. Cortex XSIAM requires this API key to authenticate to the API. Required permissions: The Admin API key must be generated by an administrator of your organization.
• Organization ID: A unique identifier that Coveo assigned to your organization.

Perform the following procedures in the order that they appear below.

Task 1: Generate and Copy the API Key for Your Organization

1. As an administrator of your organization, log in to the Coveo Administration Console.
2. In the left navigation pane, select API Keys. The API Keys item is located in the Organization section of the menu.
3. On the API Keys page, click Add key. Coveo displays the Add an API key page, which provides steps for defining the API key.
4. Follow the steps on the API key page to define your API key:

   1. On the Key purpose page, do not choose any of the predefined templates. Instead, select the Custom option to create a custom combination of privileges. Click Next.
   2. On the Identification page, specify a meaningful Name for the API key, such as Cortex XSIAM Integration. You can optionally specify a longer Description. Click Next.
   3. On the Privileges page, grant the API key the following privileges. Click Next.

      1. Groups: Organization
      2. View all: View all
5. On the Configuration page, set the Expiration date to 1 year. Click Next.
6. Do not modify the Access page. Click Next.
7. Review the details of your key on the Review page and click Add API key. Coveo generates and displays your API key.
8. Copy the API key and paste it into a text file.

Do not continue to the next step unless you have copied the API key. You will provide this key to Cortex XSIAM during the onboarding process.

Task 2: Identify Your Organization ID

1. In the left navigation pane of the Coveo Administration Console, select Settings. The Settings item is located in the Organization section of the menu.
2. On the Settings page, select the Organization tab.
3. View the organization Details, which include your Organization ID.
4. Copy your Organization ID and paste it into a text file. Do not continue to the next step unless you have copied the Organization ID. You will provide this information to Cortex XSIAM during the onboarding process.

Task 3: Connect Coveo to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.
2. Click + Add new.
3. In the Add Data Source page, search for Coveo.
4. Under Recommended, hover over the new Coveo integration and click Add Instance to launch the configuration wizard.
5. Under the Capabilities tab, Enter a Name for your application.
6. Select Security Posture under Default Capabilities.
7. Click Next.
8. Under the Connection tab, enter the Admin API Key and Organization ID.
9. Under the Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
10. A confirmation message shows that your Coveo instance is successfully connected. Confirm the Summary details and click Save instance.