Integration: Kaseya SIEM and N-able N-Central

Kaseya SIEM

NAVIGATION  Organizations > Edit Organization (pencil icon) > + New Application > N-able N-Central (under MSP Tools)

PERMISSIONS  Administrator permissions

N-able N-Central

NAVIGATION  Administration > User Management > Roles and Administration > User Management > Users

PERMISSIONS  Permissions to create roles, users, API-only users, web tokens, custom properties, and scheduled automation policies

To create a role for the integration, complete the following steps:

1. In N-Central, navigate to Administration > User Management > Roles.

2. Click Create Role.

3. Enter a name for the role. For example, Kaseya SIEM.

4. Under Custom Properties > View/Set, select Read Only.

5. Under Administration > User Management, select Read Only for:

   • Access Groups

   • Roles

   • Users

6. Scroll to Devices.

7. From the Action menu, select Read Only to apply Read Only permissions to all device subitems.

8. Click Save.

The role is now ready to be assigned to the API-only user.

To create the API-only user required for the integration, complete the following steps:

1. In N-Central, navigate to Administration > User Management > Users.

2. Click Create User.

3. Enter the required user information and password.

4. Click the Role tab.

5. Click Assign Roles.

6. Select the role created for the integration.

7. Click Assign.

8. Click the Access Groups tab.

9. Click Assign Access Groups.

10. Select All.

11. Click Assign.

12. Click the User Details tab.

13. Click the User Information subtab.

14. Ensure that MFA Not Required is selected.

15. Click the API Access tab.

16. Ensure that API-Only User is selected.

17. Click Save.

18. Click OK, and then click Save/Cancel.

The API-only user is now ready for token generation.

1. To generate the token required for the integration, complete the following steps:

2. In N-Central, navigate to Administration > User Management > Users.

3. Select the API-only user created for the integration.

4. Click the API Access tab.

5. Click Generate JSON Web Token.

6. Copy and securely store the token.

7. Click Save.

The JSON Web Token is now ready to be used when connecting N-Central to Kaseya SIEM.

IMPORTANT  Store the token securely. You will need it when configuring the N-Central connection in Kaseya SIEM.

To support Unify functionality, configure N-Central to store device public IP addresses in the IPV4_PUB custom property.

1. In N-Central, navigate to Administration > Custom Properties.

2. Click Add.

3. Select By Devices > Text Type.

4. In Property Name, enter IPV4_PUB.

5. In Default Text, enter Public IPv4 Address.

6. Ensure that all operating systems and all device classes are selected.

7. Save the custom property.

NOTE  As new operating systems are added to N-Central, edit this property and ensure that the new operating systems are included in the selected operating systems list.

To populate the IPV4_PUB custom property automatically, create and schedule the public IP address automation policy.

1. Navigate to Configuration > Scheduled Tasks > Script/Software Repository.

2. In the search bar, enter public.

3. Locate Get Public IP Address and click Clone.

4. In the Clone Repository Item screen, enter the following information:

   • Name: Get Public IP Address and Save to IPV4_PUB

   • Description: Retrieve the device public IP address and store it in the IPV4_PUB custom property.

5. Navigate to Actions > Run an Automation Policy.

6. On the Automation Policy Task > Details tab, enter the following information:

   • Task Name: Get Public IPv4 Address and store in IPV4_PUB

   • Repository Name: Get Public IP Address and Save to IPV4_PUB

   • Output Parameter (IP): IPV4_PUB

7. On the Automation Policy Task > Targets tab, ensure that Windows Agents is in the Selected Filters section.

8. On the Automation Policy Task > Schedule tab, set the task to Recurring.

9. Set the schedule to repeat every 5 minutes.

10. Click Save.

NOTE  You can select a 10-minute or 15-minute interval, but Unify functionality may be more accurate with a 5-minute interval.

To verify that the automation policy is working, complete the following steps:

1. Wait for the scheduled automation policy to run.

2. In N-Central, open a Windows device.

3. Navigate to Settings > Custom Properties.

4. Verify that the IPV4_PUB custom property is populated with the correct public IP address for the device.

1. In Kaseya SIEM, from the side navigation menu, go to Organizations.

   

2. Click Edit Organization represented by the pencil icon for the organization you want to configure.

   

3. Click + New Application.

   

4. Under MSP Tools, locate N-able N-Central and click Connect.

   

IMPORTANT  If the same N-Central instance is connected to multiple organizations, duplicate events and alerts may be generated. Unless you have multiple N-Central instances, do not add the same connection to multiple organizations.

5. In the N-Able N-Central Connection Wizard, enter the Client Domain.

   • The Client Domain is the URL used to access N-Central. Example: https://yourmsp.n-able.com

6. Enter the User-API Token (JWT) generated earlier.

7. Click Next.

8. Complete the Organization Mapping step.

9. Finish the wizard.

When the connection is successful, N-able N-Central appears under the organization's Applications tab.

To disable the integration, complete the following steps:

1. From the side navigation menu, go to Organizations.

2. Click Edit Organization (pencil icon).

3. On the Applications tab, select the N-Able N-Central tile.

4. Select Disconnect Application.

5. Confirm the action.

Kaseya SIEM stops collecting data from the connected N-Central instance.

The integration requires permissions to create a role, create an API-only user, assign access groups, generate a JSON Web Token, and configure the required custom property and automation policy.

The IPV4_PUB custom property stores device public IP addresses. This information can support Unify functionality in Kaseya SIEM.

Connecting the same N-Central instance to multiple organizations can result in duplicate events and alerts. Unless you have multiple N-Central instances, avoid adding the same connection to multiple organizations.