Integration: Kaseya SIEM and Webroot Monitor

Kaseya SIEM

NAVIGATION  At the partner level: Settings > Integrations > + New Integration > choose organization > Next > Webroot

NAVIGATION  At the organization level: Organizations > Edit Organization (pencil icon) > + New Application > Webroot

PERMISSIONS  Permission to manage integrations or organization applications in Kaseya SIEM

Webroot Monitor

NAVIGATION  Settings > Unity API Access

NAVIGATION  Settings > Account Information

PERMISSIONS  Webroot account with access to create Unity API credentials and view account information

The Kaseya SIEM and Webroot Monitor integration retrieves Webroot threat and activity data and surfaces it in Kaseya SIEM, enabling the SOC to monitor and respond to activity associated with connected Webroot organizations.

Prerequisites

  • The Webroot instance must be configured as an MSP in order for the Unity API Access menu to be available.

  • This integration requires the following information from Webroot:

    • Username

    • Password

    • Client ID

    • Client Secret

    • GSM Key (Parent Keycode)

    The Username and Password are the same credentials used to sign in to the OpenText Management Console.

How to...

To generate the credentials required for the integration, complete the following steps:

  1. Log in to the OpenText Management Console.

  2. Navigate to Settings > Unity API Access.

  3. Click Create New Client Credential.

  4. Enter a name and description for the credential.

  5. Click Next.

  6. Select Yes for Do you plan to use the Event Notification API?

  7. Select Integration with SIEM provider as the integration type.

  8. Click Save to complete the wizard.

  9. Copy and securely store the generated Client ID and Client Secret.

IMPORTANT  If Event Notification API support is not enabled, Webroot detections will not be ingested into Kaseya SIEM.

IMPORTANT  The Client Secret is displayed only when it is created. If it is lost, you must generate a new credential.

  1. In the OpenText Management Console, navigate to Settings > Account Information.

  2. Locate and copy the Parent Keycode (GSM Key).

  1. In Kaseya SIEM, navigate to Settings > Integrations.

  2. Click + New Integration.

  3. Select the organization that will receive the Webroot data, and then click Next.

    • To create a new organization and use it for the integration, click Create New Organization and use.

    • Each organization can have one connection per application type.

  4. Under Endpoint Security, locate Webroot and click Connect.

  5. In the Webroot Monitor Connection Wizard, enter the following values:

    • Username

    • Password

    • Client ID

    • Client Secret

    • GSM Key (Parent Keycode)

  6. Click Next.

  7. Complete the Organization Mapping step.

    • Select a User Activity Organization.

    • Map discovered Webroot organizations to Kaseya SIEM organizations as needed.

  8. Click Finish

When configured at the partner level, Webroot Monitor appears in Settings > Integrations and displays the associated organization.

  1. In Kaseya SIEM, from the side navigation menu, go to Organizations.

  2. Click Edit Organization (pencil icon) for the organization you want to connect Webroot to.

  3. Click +New Application.

  4. Under Endpoint Security, locate Webroot and click Connect.

  5. In the Webroot Monitor Connection Wizard, enter the following values:

    • Username

    • Password

    • Client ID

    • Client Secret

    • GSM Key (Parent Keycode)

  6. Click Next.

  7. Complete the Organization Mapping step.

    • Select a User Activity Organization.

    • Map discovered Webroot organizations to Kaseya SIEM organizations as needed.

  8. Click Finish.

When configured at the organization level, the Webroot application appears under the organization's Applications tab.

To disable the integration:

  1. Navigate to the Webroot integration.

    • If configured at the partner level, go to Settings > Integrations, locate Webroot, and select View details.

    • If configured at the organization level, go to Organizations, select the organization, and then open the Applications tab.

  2. Select Disconnect Application.

  3. Confirm the action.

Results

  • Webroot activity is no longer associated with organizations in Kaseya SIEM.

  • Existing Webroot deployments and configurations remain unchanged.

  • If Webroot is configured at the partner level, disconnecting it affects all organizations mapped to that connection.

The integration can be reconnected later using the same workflow, if needed.

FAQ

Verify that the Username, Password, Client ID, Client Secret, and GSM Key (Parent Keycode) are entered correctly. Also ensure that the Webroot account has access to the organizations being integrated and that the Client Secret has not expired or been regenerated.