# Stellar Cyber The Dropzone AI Platform integrates with [Stellar Cyber](https://stellarcyber.ai/), an AI powered SecOps platform offering security solutions such as SIEM, Network Detection & Response (NDR), Identity Threat Detection & Response (ITDR), and User Behavior Entity Analytics (UEBA). Dropzone can perform analysis cases and alerts from the Stellar Cyber Connect API, and/or use Stellar Cyber data as part of investigation analysis. ## Integration Overview To enable these integrations you will perform the following actions: * Create an API token * Install the credentials into your Dropzone tenant * Select integration parameters, such as which alert types to sync ## Create an API key Stellar Cyber requires an API key to enable. To create an API key with the necessary permissions, the user must have Root scope and Super Admin privileges. If you have access to a user with Root scope and Super Admin privileges, do the following: * As a user with the Edit User privilege, log into your Stellar Cyber instance * In the menu bar, click "System"

* Navigate to Administration > Users

* Under the Users tab, locate a user with Root scope and Super Admin privileges * Copy the email address for use later in the Dropzone UI where it is called "User Email Address"

* Under "Actions," click the Edit button

* In the API Access section, click "Generate New Token" * Copy the token shown for use later in the Dropzone UI where it is called "Access Token"

If you do not already have a user with those privileges, do the following: * As a user with the Add User privilege, log into your Stellar Cyber instance * Navigate to System > Administration > Users * Under the Users tab, click "+ Create"

* Input an email address for the User. Copy the value for use later in the Dropzone UI where it is called "User Email Address" {% hint style="info" %} Stellar Cyber requires a unique email address for all its users. We recommend creating a dedicated email address for this user, rather than using an existing company email. {% endhint %} * Name the user something memorable, such as Dropzone AI * Create a password for the user * Next to "User Scope," click "Root" * Next to "User Privilege," select "Super Admin"

* In the API Access section, click "Generate New Token" * Copy the token shown for use later in the Dropzone UI where it is called "API Key" {% hint style="info" %} If you do not copy the token when the user is created, you will need to generate a new token. {% endhint %}

## Enable Stellar Cyber To enable the Alert Source integration, you'll need the following information: | Dropzone Field | Source | | ------------------ | -------------------------------------------------------------------------------- | | Instance Domain | Your Stellar Cyber server hostname (e.g. https\://*myserver.stellarcyber.cloud*) | | User Email Address | The email address of the Stellar Cyber user you created/used earlier | | Access Token | The "Access Token" value you generated earlier | To enable the Alert Source integration, do the following: * Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app * In the bottom left hand corner, navigate to Settings > Integrations

* Click "Available"

* In the Search bar, search Stellar Cyber, then click "Configure"

* Under the Alert Source heading, input the instance domain, user email address, and access token

The Stellar Cyber Alert Source Configuration (pt 1)

* In the StellarCyber Alerts section, you may input an array of Python regex patterns to include or exclude specific [alerts](https://docs.stellarcyber.ai/prod-docs/5.1.x/Using/Alerts/Alert-Main.htm?tocpath=SECURITY%20MONITORING%7CWorking%20with%20Alerts%7C_____1) by name. To do so, select whether to exlude or include the listed threat names, then click "Add Item" and input the array. Continue adding arrays until done.

The Stellar Cyber Alert Source Configuration (pt 2)

* To enable Dropzone to poll for alerts, check the box labeled "Enable polling for alerts" * Input the [Alert Index prefix](https://docs.stellarcyber.ai/prod-docs/5.1.x/Using/ML/Machine-Learning-by-index.htm?tocpath=REFERENCE%7CDetection%20and%20Correlation%20Overview%7CAlert%20Type%20Model%20Summary%7C_____3) and minimum desired [event score](https://docs.stellarcyber.ai/prod-docs/5.1.x/Using/Alerts/Alert-Scoring.htm?tocpath=SECURITY%20MONITORING%7CWorking%20with%20Alerts%7C_____6) of the alerts you want Dropzone to investigate

The Stellar Cyber Alert Source Configuration (pt 3)

* To enable Dropzone to poll for [cases](https://docs.stellarcyber.ai/prod-docs/5.1.x/Using/Cases/Cases-Main.htm?Highlight=case), check the box labeled "Enable polling for cases" * Input your minimum desired [score](https://docs.stellarcyber.ai/prod-docs/5.1.x/Using/Cases/Cases-Understanding.htm?tocpath=SECURITY%20MONITORING%7CWorking%20with%20Cases%7C_____2), then check the boxes for each [severity level](https://docs.stellarcyber.ai/prod-docs/5.1.x/Using/Cases/Cases-Detail.htm?tocpath=SECURITY%20MONITORING%7CWorking%20with%20Cases%7C_____3) you want Dropzone to investigate

The Stellar Cyber Alert Source Configuration (pt 4)

* In the "Custom Filtering" section, you may input an array of Python regex patterns to include or exclude specific cases by name. To do so, check the box labeled "Enable Custom Filtering," select whether to exlude or include the listed threat names, then click "Add Item" and input the array. Continue adding arrays until done.

The Stellar Cyber Alert Source Configuration (pt 5)

* To limit Dropzone's access to specific [tenants](https://docs.stellarcyber.ai/prod-docs/5.1.x/Common/Using-Tenants.htm?Highlight=tenant%20id) within Stellar Cyber, check the box labeled "Manually Specify Tenant IDs," then click "Add Item." Input the Tenant [ID](https://docs.stellarcyber.ai/prod-docs/5.1.x/Configure/People/Tenants-Managing.htm?tocpath=CONFIGURING%7CManaging%20Access%7CManaging%20Tenants%7C_____2) you want Dropzone to investigate alerts for. Continue adding Tenant IDs until done.

The Stellar Cyber Alert Source Configuration (pt 6)

* Input your desired poll interval and lookback

The Stellar Cyber Alert Source Configuration (pt 7)

* Click "Test & Save" to finish If you have any errors or questions, engage your Dropzone AI support representative.