Kustomer

Use Kustomer data with Cortex XSIAM.

The capabilities and sub-capabilities listed for this connector are available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

This connector includes the following capabilities and sub-capabilities (if applicable):

• Security posture: Detect, monitor and alert on settings of your SaaS application.

  • saas-posture-config-remediation: Help remediate the misconfigured security settings of your SaaS application.

How to configure the Kustomer connector

To access Kustomer, Cortex XSIAM requires the following information, which you will specify during the connection process.

• API Key: A generated character string that uniquely identifies your organization to the Kustomer API. Cortex XSIAM requires this API key to authenticate to the Kustomer API. Required permissions: The API key must be generated by an administrator and configured with the org.permission role.

• Region: The region (US or EU) where your organization deployed Kustomer.

Task 1: Generate and Copy an API Key

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Kustomer instance from Cortex XSIAM.

1. Log in to Kustomer as an administrator.

   1. Open a web browser and go to the Kustomer login page at www.kustomerapp.com/domain. Enter your organization name and click Continue.

2. Log in using administrator credentials.

3. Generate an API key for your organization.

   1. Click the settings icon (gear icon) in the lower-left corner of the window and select Security > API Keys.

   2. Click + Add API Key.

   3. Fill in the fields of the Add API Key dialog:

      1. Enter a name for the new API key.

      2. In the Roles field, specify org.permission. Required permissions: The key must be configured with the org.permission role.

      3. Specify an expiration date for the key.

   4. Click Create. Kustomer generates and displays your new key.

   5. Copy the API key and paste it into a text file. Do not continue to the next step unless you have copied the API key. You must provide this key to Cortex XSIAM during the onboarding process.

4. Identify the region (United States or European Union) where your organization instance was deployed. Because API calls are region-specific, you must provide this information to Cortex XSIAM during the onboarding process.

Task 2: Connect Kustomer to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.

2. Click + Add new.

3. In the Add Data Sources or Integrations page, search for Kustomer.

4. Under Recommended, hover over the new Kustomer integration and click Add Instance to launch the configuration wizard.

5. Under the Capabilities tab, Enter a Name for your application.

6. Select Security Posture under Default Capabilities.

7. Click Next.

8. Under Connection, enter your API Key and Region.

9. Under Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. A confirmation message indicates that Kustomer is successfully connected. Confirm the Summary details and click Save instance.