Setting Up Integrations

Integrate Cortex XSOAR with Your KnowBe4 Console

In this article, you can learn how to integrate Cortex's XSOAR platform with the KMSAT console. Once you set up this integration, you'll be able to send your users' KMSAT security awareness training and simulated phishing data to XSOAR. For example, you can use commands to send specific Risk Score or Phishing Security Test (PST) data. Then, you can use this data for your automations, playbooks, and reports in XSOAR. 

See the sections below to learn how to integrate XSOAR with KMSAT. To learn about the benefits of integration, see our Cortex XSOAR and KnowBe4 document.

Configuring the Integration

To configure the integration, follow the steps below:

  1. Log in to your XSOAR account.
  2. Navigate to Settings > Integrations > Servers & Services.
  3. In the search bar at the top of the page, search for “KMSAT”.
  4. Click Add instance to create and configure a new integration instance.
  5. Fill out the parameters with information about your KMSAT console. For more information, see the table below:
    Parameter Description Requirement

    Instance Name

    Enter a name for your KMSAT instance.

    Required

    Reporting Server URL

    Enter the Reporting Server URL for your KMSAT instance, which you can find in our Reporting API documentation.

    Required

    Reporting API Key

    Enter the Reporting API key for the connection. To generate an API key, see our KMSAT Account Settings: Account Integrations article.

    Required

    User Events Server URL

    Enter the User Event URL for your KMSAT instance, which you can find in our User Event API documentation.

    Required

    User Events API Key

    Enter the User Event  API key for the connection. To generate an API key, see our User Event API article.

    Optional

  6. Click Test to validate the URLs, API keys, and connection.

Using Commands

After adding the integration, you can use commands to send data from KMSAT to XSOAR. 

For a list of commands you can use, see the table below:

Command Description

kmsat-account-info-list

Use this command to send account information.

kmsat-account-risk-score-history-list

Use this command to send your organization's Risk Score history.

kmsat-groups-list

Use this command to send a list of your groups.

kmsat-groups-risk-score-history-list

Use this command to send Risk Score history for your groups.

kmsat-groups-members-list

Use this command to send groups and the users who are included in them.

kmsat-users-risk-score-history-list

Use this command to send the Risk Score history for your users.

kmsat-phishing-security-tests-list

Use this command to send all PSTs.

kmsat-phishing-security-tests-recipients-list

Use this command to send PSTs and user data for enrolled users.

kmsat-phishing-security-tests-failed-recipients-list

Use this command to send failed PSTs and user data for enrolled users.

kmsat-phishing-campaign-security-tests-list

Use this command to send PSTs from a specific phishing campaign.

kmsat-training-campaigns-list

Use this command to send all training campaigns.

kmsat-training-enrollments-list

Use this command to send all training enrollments.

kmsat-user-events-list

Use this command to send user events.

kmsat-user-event-types-list

Use this command to send the types of user events.

kmsat-user-event-create

Use this command to create an event on a user's User Timeline.

kmsat-user-event-delete

Use this command to delete an event from a user's User Timeline.

For more information, see Cortex XSOAR's KnowBe4 KMSAT documentation.

Can't find what you're looking for?

Contact Support
circle-arrow-up