Overview

The Secberus Push API is a GRPC based service that enables users to push custom data sets into the Secberus platform. The Push API is the facility for users to be able to add any data they need to Secberus, that the Secberus collector does not already fetch.

The Push API allows users to create new tables in the data warehouse and add records to those tables. The tables created by the Push API live side-by-side with any tables created by the Secberus collector, so the data sets can be combined in the Secberus Data Explorer enabling:

1. Highly contextual data in violations making exceptions, remediation, and reporting more robust.
2. Lessen the frequency of false positives/negatives.
3. Add data defining compensating controls.
4. Add entirely new, discrete data sources for use in the Secberus platform.

Set up

The Push API is configured just like any other data source in the Secberus platform. Where other data source types (AWS, Azure, etc.) require a user to enter a set of configurations and credentials for the Secberus collector to be able to connect and pull data, when a user creates a new Push API data source, Secberus will present the user with a set of credentials generated by Secberus for that specific Push API client.

These credentials can be used with either a custom GRPC client developed by a customer, or the provided Secberus push API client. Each of these client options is discussed in more detail in this section.

The first step in creating a new Push API client is to create a new "Custom Data source" in the Secberus Settings.

Just give your custom data source a unique name and submit.

You will then be presented with a file to download. Click on the "Download Bundle" button and choose a location to download the custom data source credentials. This file is what your custom data source will use to authenticate to the Secberus platform.

The details of the credentials file and Push API authentication are discussed in detail here.

📘

Note

Each data source is tied to a unique credentials file. The tables created with a set of credentials can only be read or written to by a client using those same credentials. For example, if you create two custom data sources and have two different credentials files, A and B. If you create a table called "table_1" using credentials A, the client using credentials B will not be able to see that table, nor write records to it.

The custom data sources are meant only for getting data into the Secberus platform. Once the data is there, all tables are accessible and available in the Data Explorer for read operations.