Add Third-Party Alert Sources to Red Canary

1. From your Red Canary homepage, click Integrations.

2. From the Integrations section, locate and then click the security product you want to integrate with Red Canary.

   Note: If you do not see your security product listed, click See all integrations. 

3. In the search bar, type and then select your third-party security source.

4. Continue onto the next step by configuring your third-party security source in Red Canary.

1. In the Name field, enter the security product.

2. Select a display category. 

3. Select an ingest format or method. For example, API Poller, Email, Syslog, HTTP, and TCP.

   1. API Alert sources may require addition configuration to configure. Follow the inline instructions to complete the configuration before moving on to Step 4.

4. Click Save Configuration.

   

5. You now need to parse the alerts that will be coming into Red Canary. Click Activate to begin processing alerts. 

6. Click Edit Configure to view the URL that you will be sending alerts to. From here you will notice a new section on the window. You will be able to view the URL and Port where your security product will send the alerts to.

   

Red Canary TLS Certificate for Ingest over TLS (Recommended) 

If you are using Syslog, HTTP, or TCP, Red Canary requires that you configure your third party product to send alerts to the Provided URL and Port number highlighted below. When you are finished, click Save Configuration or exit the modal. 

Custom TLS Certificate for Ingest over TLS (Optional)

If you do not want to use the recommended configuration, you can use this one. If your company has security requirements, or if the third-party product you are adding requires a custom certificate, you can use a custom TLS server certificate. 

Note: Red Canary supports customer self-signed certificates but doesn’t support the uploading of third-party CA signed certificates.

1. Select Use custom TLS server certificate for ingest over TLS?. Click Choose File, then select the certificate and private key files. You can also enter a private key passphrase if you choose to. 

2. Click Save.

   

3. You’ll receive an update in the Red Canary platform that the external alert source was successfully updated.

Note: What does Enable process correlation for user-defined alerts mean? Many EDR platforms allow users to create their own list of rules that can trigger alerts. These alerts are typically high volume and, from an MDR perspective, usually have little to no value and may even hinder alert analysis. Process correlation requires Red Canary to make additional calls to EDR APIs, so enabling process correlation for these alerts may cause Red Canary to exceed rate-limits. Therefore, process correlation for these alerts is not enabled by default on new and existing alert sources.

For email-based alerts, trigger an alert or email in the source platform.

Note: There is no integrated test functionality for API-based alerts at this time.