Upwind (Beta)

Upwind (Beta)

The Dropzone AI platform integrates with the Upwind Management API to enrich investigations with context from Upwind, such as runtime threat detections, vulnerabilities, cloud configuration findings, and cloud inventory.

Integrations Overview

To enable this integration you will perform the following actions:

• Locate your Upwind region and organization ID

• Create an Upwind API credential with read-only access

Region and Organization ID

Your Upwind organization is hosted in one region: US, EU, or ME. If you are unsure which, contact your Upwind representative.

Your organization ID looks like org_Xk9mPq7RtYwN2vLs. You can find it in the Upwind Console under your organization settings.

Create an Upwind API credential

You need the Settings Editor and Access Management Admin roles in Upwind to create credentials. A credential can never have more access than the member who creates it.

• In the Upwind Console, navigate to Settings > Access Management > Credentials

• Click to generate a new credential and choose API as the credential type

• Give the credential a name, e.g. dropzone-read

• Set the scope to Global Scope. Dropzone cannot see resources outside the credential's scope, and the scope cannot be changed after the credential is created.

• Assign the Global Reader role

If you prefer narrower access, assign these feature roles instead of Global Reader: Threats Reader, Vulnerabilities Reader, Configurations Reader, Api Security Reader, and Identities Reader. Threats Reader is required. Note that Api Security Reader on its own only covers Upwind's API Security product and is not sufficient.

• Save the credential and copy the Client ID and Client Secret. Upwind shows the Client Secret only once.

You can change a credential's roles later from its side pane in the Credentials tab. Changes apply to new tokens, so they take effect within 24 hours or on the next "Test & Save".

Enable Upwind

To enable the Data Source integration, you'll need the following information:

Dropzone Field	Source
Region	Your Upwind region: US, EU, or ME
Organization ID	Your Upwind organization ID copied earlier
Client ID	The Client ID of the API credential
Client Secret	The Client Secret of the API credential

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the left side bar, navigate to Platform Settings > Integrations

Integrations Dropdown

• Click "Library"

If you have previously integrated this application, click "Configured"

Click Library

• In the Search bar, search Upwind, then click "Configure"

• Under the Data Source heading, select your region and input the Organization ID, Client ID, and Client Secret

• Click "Test & Save" to finish

Troubleshooting

"Test & Save" checks that the credential can authenticate and read each area of the Upwind API that Dropzone uses.

• Upwind rejected the client credentials: check the Client ID, Client Secret, and region. A credential only works in the region your organization is hosted in.

• The Upwind credential cannot read threat stories (missing: threats:ListStories): the credential is missing the Threats Reader permission. Edit the credential's roles to add Global Reader, or at least Threats Reader.

If you have any other errors engage your Dropzone AI support representative.