Apps
Devo
Interpres Application - Devo SIEM
- Type: SIEM/Data Lake
- Vendor: Devo
The Devo SIEM is a cloud SIEM platform with the ability to ingest any type of data into their cloud database offering. This integration will get detections, alerts and telemetry from the Devo platform.
- Before beginning make sure you have administrator privileges in the Devo platform.
- Navigate to the Devo Platform and login to the domain you wish to configure. Currently if you have multiple domains you must setup multiple Interpres integrations.
- Navigate to the following page in Devo UI: Administration -> Credentials ->Tokens
- Create the following tokens
- Alert API Token
- Please enter in any name, authorize user.
- For target tables select *.** (All user tables)
- For type please select Alert API (Create and manager alerts using the API)
- After creating please click into the new token and copy down the Token code
- Query API Token
- Please enter in any name, authorize user.
- The token will need access to the following tables:
- siem.logtrust.collector.counter
- my.lookuplist.SecOpsAlertDescription
- box.all.win: only if Windows logs are being ingested in the Devo domain
- cloud.aws.cloudtrail: only if Cloudtrail logs are being ingested in the Devo domain
- For type please select Query API (Query data and manage all domain jobs)
- After creating please click into the new token and copy down the Token code
- Please note down which Devo region you are logging into, more information can be found here: Link to Devo regions
- For the corresponding region please look up the following API endpoints and note them down:
Once finished you should have the following information
- Devo UI URL : step 5
- Base Alert URL: step 5.1.1
- Base Query URL: step 5.1.2
- Alert Token: step 4.1.4
- Query Token: step 4.2.4
- Query Token: Query token used to make requests against query
- Alert Token: Alert token used to make requests against alerts
If configured correctly this integration will pull down all detections defined in the Devo platform and periodically pull in all triggered alerts from Devo. It will also periodically check for available telemetry.
- Get Alerts: Gets the latest alerts using the Devo Alert API.
- Get Available Telemetry: Returns a list of telemetry identifiers with their current status. It queries the table siem.logtrust.collector.counter
- Get Detections: Returns a list of detections using the Devo Alert API.