Integration: Kaseya SIEM and Deep Instinct

Kaseya SIEM

NAVIGATION  At the partner level: Settings > Integrations > + New Integration > choose organization > Next > Deep Instinct

NAVIGATION  At the organization level: Organizations > Edit Organization (pencil icon) > + New Application > Deep Instinct

PERMISSIONS  Permission to manage integrations or organization applications in Kaseya SIEM

Deep Instinct

NAVIGATION  Settings > Integration & Notification > API Connectors

PERMISSIONS  Deep Instinct account with permission to create API Connectors and generate API tokens

To generate the credentials required for the integration, complete the following steps:

1. Sign in to the Deep Instinct portal.

2. Copy the tenant URL used to access the portal. This value is used as the Client Domain in Kaseya SIEM.

   EXAMPLE  https://partner1.poc.deepinstinctweb.com

   IMPORTANT  Do not include any portion of the URL after .com, such as: /login or /dashboard

3. Navigate to Settings > Integration & Notification > API Connectors.

   

4. Select Add Connector.

   

5. Complete the connector configuration:

   • Name: Kaseya SIEM

   • Tenants: All Tenants

   • Permission: Read and Remediation

6. Select Create to save the settings and create the API Key. The API Connectors pane displays.

   

7. Copy and securely store the generated API token.

   

1. In Kaseya SIEM, navigate to Settings > Integrations.

   

2. Click + New Integration.

   

3. Select the organization that will receive Deep Instinct telemetry and click Next.

   • To create a new organization and use it for the integration, click Create New Organization and use.

   

4. Under Endpoint Security, locate Deep Instinct and click Connect.

   

5. In the Deep Instinct Monitor Connection Wizard, enter the Client Domain and API Token obtained from Deep Instinct.

   

6. Click Next.

7. Complete the Organization Mapping step and save the integration.

When configured at the partner level, Deep Instinct appears in Settings > Integrations and displays the associated organization.

1. In Kaseya SIEM, navigate to Organizations.

2. Click Edit Organization (pencil icon) for the organization you want to connect.

3. Click + New Application.

4. Under Endpoint Security, locate Deep Instinct and click Connect.

5. In the Deep Instinct Monitor Connection Wizard, enter the Client Domain and API Token obtained from Deep Instinct.

6. Click Next.

7. Complete the Organization Mapping step and save the integration.

When configured at the organization level, the Deep Instinct application appears under the organization's Applications tab.

During setup, follow the organization-mapping steps presented in the wizard.

Organization mapping determines:

• Which organizations receive Deep Instinct telemetry

• How endpoint activity is scoped for investigation and correlation

• Where alerts and activity appear in the SIEM experience

For an overview of how integrations are associated with organizations, see Connecting data sources and integrations.

After the integration is connected:

• The Deep Instinct tile should reflect an active or connected status.

• Deep Instinct telemetry may become available for investigation, depending on configuration and available data.

• Deep Instinct activity may appear alongside other endpoint, network, or SaaS sources during investigations.

Alerts generated from ingested telemetry can be delivered to external systems such as PSAs, depending on your notification and PSA configuration. For more information, see Notifications, PSA, and external communications.

To disable the integration:

1. Navigate to the Deep Instinct integration.

   • If configured at the partner level, go to Settings > Integrations, locate Deep Instinct, and select View details.

   • If configured at the organization level, go to Organizations, select the organization, and open the Applications tab.

2. Select Disconnect Application.

3. Confirm the action.

   Results

   • Deep Instinct telemetry is no longer associated with organizations in Kaseya SIEM.

   • Existing Deep Instinct deployments and configurations remain unchanged.

   • If Deep Instinct is configured at the partner level, disconnecting it affects all organizations mapped to that connection.

   • The integration can be reconnected later using the same workflow if needed.

If the integration cannot authenticate:

• Verify the API token is valid and has not expired.

• Verify the Client Domain matches the Deep Instinct portal URL.

• Verify the URL does not contain /login, /dashboard, query parameters, or a trailing slash.

• If the API token is regenerated, update the credentials in Kaseya SIEM and reconnect the integration.