Create

If you are new to integrations you should review Integrations Overview

Create Integration

From the SamurAI Portal click Telemetry and select Integrations from the main menu.
Click Create integration.
Select the product you wish to integrate with the SamurAI platform.
Click Next. Dependent on how we collect telemetry, the product may be integrated via a Cloud Collector or Local Collector. Follow the steps based on the Collector type:

Cloud Collector

If the integration is cloud-based you need to select the relevant Cloud Collector. Select the relevant Cloud Collector and click Next.
- If you are using a public cloud storage account you should already have completed the steps in Cloud Collector.
- If no cloud storage is utilized then a default cloud collector is available.
Select Configuration Guide which will direct you to SamurAI documentation outlining how to configure your product and obtain required fields.
Once you have configured your product, complete the required fields.
Select Finish.

Local Collector

Your Local Collector(s) will be listed. Select the Local Collector that you will integrate the product with.
Click Next (typically this is the syslog destination host when configuring your device). If you do not have a Local Collector setup and deployed, follow the steps in our SamurAI Local Collector article.
The Local Collector IP Address will be displayed, copy the IP address or take note of it.
Click Configuration Guide which will direct you to SamurAI documentation outlining how to configure your product.
Based on the product, Extended Data Collection may be displayed, if so jump to Extended Data Collection.
Click Finish

You do not need to follow the steps above for a Local Collector integration without extended data collection, however we advise you follow the steps to determine if extended data collection is available for the product, and if you wish to enable it. You may choose to follow our integration guides to send logs directly to your Local Collector, the SamurAI platform will auto detect the vendor and product for supported integrations. If we do not support the product, your integration will be displayed as unknown under the Vendor and Product fields, however the SamurAI platform will still store the telemetry data.

Extended Data Collection

For many products we are able to collect extended data enhancing our threat detection capabilities and accuracy, for example Packet Capture (PCAP) data. This option will be displayed during configuration of an integration.

If extended data collection is available for the product, you can choose to enable or disable via the toggle. If you choose to disable, Select Finish
If you choose to enable extended data collection you must complete all the necessary fields. The parameters for each field are derived from following the associated product configuration guide. Once complete, Select Finish

You can choose to follow the configuration guide at anytime during the process, however if your product is not configured, the SamurAI platform will obviously not receive any telemetry.

All supported third-party product configuration guides can be found here.