Integration: Kaseya SIEM and Kaseya BMS

Kaseya SIEM

NAVIGATION  Settings > PSA and Email > + Add PSA

PERMISSIONS  Ability to configure PSA integrations and manage API credentials

Kaseya BMS

NAVIGATION  Admin > Security > Roles; HR > Employees

PERMISSIONS  Ability to create API users or assign roles with ticketing and account access

The Kaseya BMS integration allows Kaseya SIEM to create and manage service tickets based on detected events.

Once configured, Kaseya SIEM can generate and update tickets in Kaseya BMS, enabling teams to track and respond to security activity using existing service desk workflows.

Prerequisites

  • Active Kaseya BMS account

  • API user credentials for BMS

  • API user has permission to:

    • View account information

    • Create and update service desk tickets

    • At least one contact exists for each BMS customer used for ticketing

  • At least one contact exists for each BMS customer used for ticketing

  • A default (catch‑all) customer and contact are defined for unmapped organizations

  • Default ticket values (such as type, status, queue, and priority) are defined in advance

Use case

You are using Kaseya SIEM to monitor activity across endpoints and want detected issues to automatically generate service tickets in Kaseya BMS.

During configuration, organizations in Kaseya SIEM are mapped to BMS customers. When events generate tickets, they are assigned to the mapped customer and contact. If no mapping exists, tickets are assigned to the default customer and contact.

How to...

  1. Go to Admin > Security > Roles.

  2. Click + New to create a new security role or select an existing role.

  3. Ensure the role includes permissions to:

    • View accounts

    • Create and update tickets

    • API access

    Section Module Name View Modify Delete
    Home My tickets x x
    Service Desk Tickets x x
    CRM Accounts x
    Admin Service Desk x x
    Admin (Special Features) Has API Access Select the checkbox

  4. Click Save.

  5. Go to HR > Employees.

  6. Create a new user with User Type set to Api Employee.

  7. Assign the security role to the user.

  8. Save the user and set a password.

Use this user’s credentials when configuring the integration in Kaseya SIEM

To enable the integration, complete the following steps:

  1. From the side navigation menu, click Settings.

  2. Select PSA & Email.

  3. Click + Add PSA.

  4. Select Kaseya.

Connection wizard in Kaseya SIEM

  1. Enter the following Kaseya BMS credentials (see Prepare Kaseya BMS for integration).

    • Kaseya BMS URL

    • BMS tenant (this is your registered company name. You can find it by navigating to My Profile > My Settings > Company Name)

    • BMS username

    • BMS password

  2. Click Next and complete the configuration. During setup, you will configure organization mapping and ticket defaults.

    If authentication is successful, the configuration wizard continues to organization mapping.

After the Kaseya BMS credentials are validated, the wizard moves to Account Mapping.

This step is required. The integration cannot be completed until a default PSA account is selected and organization mappings are defined.

Account default (required)

Select a Catch‑All PSA Account. This account is used when a specific Kaseya SIEM organization does not have an explicit mapping.

When Attach Contacts to Tickets on Creation is enabled:

  • The selected PSA account must have at least one contact.

  • Kaseya SIEM attempts to match a PSA contact using the email address included in the alert.

  • If a matching contact is found, it is attached to the ticket.

  • If no matching contact is found, the ticket uses the default contact for the mapped PSA account.

  • If no contact exists, the wizard displays a validation message and prevents you from continuing.

When Attach Contacts to Tickets on Creation is disabled:

  • Tickets are created without associating a contact.

  • The wizard allows you to proceed even if the PSA account has no contacts.

Mapping PSA accounts to organizations

Use the mapping table to associate Kaseya BMS accounts with Kaseya SIEM organizations.

You can:

  • Filter PSA accounts by account type, classification, or market segment

  • Map individual PSA accounts to the appropriate MDR organization

  • Assign a specific contact per mapped account (optional)

  • Ignore PSA accounts that should not be available for mapping

Only mapped organizations will route tickets to their corresponding PSA accounts. Unmapped organizations fall back to the catch‑all account.

After completing the required mappings, select Next to continue the wizard.

For conceptual details on how organization mapping works and why it is required, see Connecting data ssources and integrations.

In this step, you define the default ticket properties used when Kaseya SIEM creates Kaseya BMS tickets, along with optional overrides for specific alert types or rules.

Several fields in this step are required. The wizard will not allow you to continue until mandatory defaults are set.

Ticket defaults (required)

Ticket defaults define how all new tickets generated from Kaseya SIEM are created in Kaseya BMS unless overridden later in this step.

You must configure the following:

  • Ticket Category: The category applied to all new tickets.

  • Ticket Type: The Kaseya BMS ticket type used for new tickets.

  • Ticket Status: The initial status assigned to new tickets.

  • Ticket Queue: The service queue where new tickets are placed.

  • Ticket Source: The source value assigned to tickets created by Kaseya SIEM.

  • Ticket Subject: The subject format used for ticket creation and ticket grouping.

  • Alert Priority Mapping: How Kaseya SIEM alert severities (for example, Critical and Medium) map to Kaseya BMS ticket priorities.

These defaults apply globally unless a custom mapping is configured below.

Ticket subject and grouping behavior

The Ticket Subject determines both:

  • The subject line of newly created tickets

  • How subsequent alerts are grouped as notes or activities on existing tickets

Choose a subject format that aligns with how you want related alerts grouped within Kaseya BMS.

Note defaults (required)

When Kaseya SIEM adds notes to an existing Kaseya BMS ticket, these settings control how the note is created.

You must configure:

  • Note Type: The Kaseya BMS note type used when adding notes

  • Note Visibility: Who can see notes added by Kaseya SIEM

  • Note Title: The title format used for notes

These settings are required even if alerts are grouped into existing tickets.

Custom Issue Type and Sub‑Issue mappings (optional)

You can optionally override the default Issue Type and Sub‑Issue Type for specific cases.

Separate mapping sections are available for:

  • Alert‑based mappings: Override values based on specific Kaseya SIEM event types

  • Respond Rule mappings: Override values for alerts generated by specific Respond Rules

  • IOC Rule mappings: Override values for alerts generated by specific IOC rules

When a custom mapping is configured and matches, the custom Issue Type / Sub‑Issue Type is used.

Otherwise, the global defaults defined above are applied.

Leaving these sections empty uses the global defaults for all tickets.

Completion criteria

You can proceed to the next step once:

  • All required ticket defaults are configured

  • Required note defaults are set

  • Any optional custom mappings are either completed or intentionally left blank

This step controls how Kaseya BMS agreements/contracts are associated with tickets created by Kaseya SIEM and, optionally, how billable user counts are synchronized.

Contract mapping is optional. If no contract functionality is enabled, you can finish the wizard without configuring this step.

Agreement / contract functionality

Use these toggles to enable contract‑related behavior:

  • Add Agreements / Contracts to Tickets: When enabled, the selected Kaseya BMS agreement or contract is added to each ticket created for the organization.

  • Sync Billable Users to Contracts / Agreements: When enabled, billable user counts from Kaseya SIEM are synchronized to the mapped Kaseya BMS agreement on a scheduled basis.

  • User Sync Day: Specifies the day of the month when billable user counts are synchronized to Kaseya BMS.

Enabling billable user synchronization does not affect alert creation or investigation behavior. It only updates contract quantities in Kaseya BMS.

Contract defaults (conditional)

If Sync Billable Users to Contracts / Agreements is enabled, a Default Contract Service is required.

  • The default contract service is used when user counts are synchronized and no organization‑specific service override is defined.

  • If no default service is selected while synchronization is enabled, the wizard displays a validation message and prevents completion.

If billable user synchronization is disabled, the default contract service is not required.

Contract mapping by organization

Use the Contract Mapping table to associate Kaseya BMS contracts with Kaseya SIEM organizations.

  • For each organization, you can:

  • Select the Kaseya BMS contract to associate with tickets

  • Choose whether the default contract service should be added to that contract

  • Optionally review or override cost and price values (if applicable)

Organizations without a mapped contract will:

  • Still generate tickets (if ticket creation is enabled)

  • Not receive contract association or user count updates

Completion criteria

You can finish the wizard when one of the following is true:

  • Contract functionality is disabled, and no defaults are required

  • or

  • Required toggles are enabled and all mandatory fields (such as Default Contract Service) are configured

Contract mapping affects ticket enrichment and billing alignment only.

It does not:

  • Change alert detection

  • Modify alert severity

  • Affect investigations or SOC workflows

When the integration is completed successfully, Kaseya BMS appears as Active in Settings > PSA & Email, and a confirmation message is shown in the upper‑right corner of the interface.

To disable the integration, complete the following steps:

  1. From the side navigation menu, click Settings.

  2. Select PSA and Email.

  3. Locate the Kaseya BMS integration.

  4. Do one of the following:

    • To temporarily stop ticket creation, use the toggle to pause the integration.

    • To permanently remove the integration, click the delete (trash) icon and confirm the removal.