Heimdal Security

Samurai [Local] Collector	Samurai [Cloud] Collector

The current Heimdal Security API provides a single timestamp of events based on the endpoint. If there are any delays in the endpoint transmitting events to Heimdal or if the endpoint time is out of sync may result with events not being ingested into the Samurai platform. We have made concessions to work around the limitation however we cannot guarantee that all events will be ingested into the Samurai platform.

To complete this Integration you will need to:

1) From the Heimdal Security Dashboard

Create a Heimdal Dashboard account
Create a Personal API Key

2) From the Samurai MDR portal

Complete the Heimdal Security integration

Create a Heimdal Dashboard Account

Follow the steps outlined in the Heimdal Security documentation:

Creating a new Heimdal Dashboard account

This account will only be used for API access from the Samurai platform therefore ensure you utilize appropriate credentials that you will manage. We recommend populating only the minimum fields required and not enabling reports and alerts whilst ensuring the account is activated under Miscellaneous Settings.

When creating the account you must ensure the timezone is set to UTC+00:00 and must not be changed.

If your organization applies IP restrictions to Heimdal acccounts you will need to raise a ticket in the Samurai MDR portal to obtain the relevant IP Addresses of the SamurAI platform.

Create a Personal API Key

Follow the steps outlined in the Heimdal Security documentation:

Heimdal Security APIs

Take note of the Customer ID and select Copy key as you will need this to Complete the Heimdal Security Integration

Complete the Heimdal Security Integration

You will need:

CustomerID: (captured during the steps Create a Personal API Key)
API Key: (captured during the steps Create a Personal API Key)

Login to the Samurai MDR portal
Click Telemetry and select Integrations from the main menu
Click Create
Find and select *Heimdal Security
Enter a Name of Integration
Enter a Description (Optional)
Enter the CustomerID
Enter the API Key
Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.