Gatewatcher
1) Connector overview
Type
NDR
Vendor documentation
Available from your Gatewatcher platform, once signed in.
Pre-filtered link
Yes. Opens the Alerts page of your GCenter, filtered on the IP address of the target as destination, the IP address of the Attack Vector as source, and the execution window of the event.
API data retrieval
Yes. For each alert: alert name, risk, engine and date. The name of the alert links to its details in the GCenter console.
Qualification modes
Semi-automatic only
Automatic behavior
N/A
See Connectors for how the pre-filtered link, data collection and qualification modes work, and Event statuses & severity for the meaning of the detection statuses.
2) Configuration
Before you start
You need:
- a GCenter account allowed to create API keys and to manage the IP addresses allowed to reach the API;
- the API URL of your GCenter;
- HTTPS access from BlackNoise to your GCenter API URL. For on-premises instances, allow inbound HTTPS traffic from BlackNoise to the API URL on the configured port. BlackNoise initiates all connections. The Gatewatcher configuration window in BlackNoise displays the source IP address.
Prepare Gatewatcher
BlackNoise reads your Gatewatcher alerts through the GCenter API, with an API key.
Step 1 - Create an API key. In your GCenter, create an API key for BlackNoise and copy it. The key gives access to your Gatewatcher data: store it in your password manager, and never paste it into a ticket or a chat.
Step 2 - Allow BlackNoise on the GCenter. The GCenter only accepts API calls from allowed IP addresses. In BlackNoise, open Resources > Connectors and click Configure on the Gatewatcher card: a Whitelist required message displays the IP address of your BlackNoise platform. Add this address to the IP allow list of your GCenter. Until it is allowed, the connection test fails.
Fill in the connector in BlackNoise
In BlackNoise, open Resources > Connectors and click Configure on the Gatewatcher card.
GCenter URL
Address of the API of your GCenter
The address of your GCenter
API key
Key that allows BlackNoise to read your Gatewatcher alerts
Created in step 1
The same window offers an option to disable verification of the TLS certificate of your GCenter. See Connectors for when to use it.
Click
Save and connect. BlackNoise calls the GCenter API with your key to check that the URL and the key are valid, and the connector becomes operational if the test passes.
