--- title: Integrations Integrations Center slug: integrations-integrations-center docTags: createdAt: 2026-10-23T17:21:09.660Z --- 1 ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/v0PmIFRp681qGDGsoRFI4_image.png" size="137" isUploading="false" width="1366" height="860" darkWidth="1366" darkHeight="860" showCaption="false"} Screen: Integrations Center (1/2) ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/IBmOTSX8OhlqW0M_o7gab_image.png" size="137" isUploading="false" width="1366" height="860" darkWidth="1366" darkHeight="860" showCaption="false"} Screen: Integrations Center (2/2) All connections with other systems live in one place: **Integrations › Integrations Center**. Each connection shows what it is used for, and each screen that uses it (alerts, directory, ITSM, reports) configures only its own use. The tabs are **Catalog**, **Connection health**, **Federation**, **API and integration accounts** (with permission to administer the API) and **History**. ### What you can do here Find an integration in the **Catalog** by direction, category, state or name, and connect it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/jdAZtKoqmfBYl9q3tefdW_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Test a connection step by step, edit it, turn each of its uses on or off, or disconnect it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-b90Hf4mIH3A-FhyatLoo_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Follow problems in **Connection health** and changes in **History**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/xn1g5Ii98Xa5IjgzkflHL_image.png" size="10" isUploading="false" width="16" height="12" darkWidth="16" darkHeight="12" showCaption="false"} Publish Hive events to an event bus (Kafka, RabbitMQ, Azure Service Bus, AWS SNS, Google Pub/Sub). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/zdNEBF8bziO2-fMhLjw0k_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### Catalog 1. Open **Integrations › Integrations Center**. The **Catalog** tab opens. 2. Filter by **Direction** (**All**, **Inbound**, **Outbound**, **Inbound and outbound**), by **Category** (Identity and directories, Messaging and notifications, Event buses and queues, ITSM and service desk, Clouds, Virtualization and Kubernetes, MDM, Security and reputation, SIEM and logs, BI, AI, GRC and risk, Inventory and CMDB) and by **State** (Connected, Attention, With error, Available), or type in **Search integration**. 3. Integrations already connected come first, with **Open**. The others show **Connect**: 4. most open the connect form below; 4. clouds, virtualization, Kubernetes and MDM (Intune, Jamf, Workspace ONE) open their own screen; 6\. Grafana, Power BI and GRCS open the **New integration account** wizard with the scopes already chosen. ### Connect Click **Connect** on a catalog card. The form has three steps. Fill in the fields of the integration. Secrets (tokens, passwords, keys) go straight to the vault and are never shown again. Addresses must be public https addresses. Right after you connect, Hive tests the connection step by step and shows where it fails and how to fix it (for example "Update the credential in the vault" or "Check the address"). Review and click **Connect**. The first use is turned on; turn on the others in the connection page with **Open the connection**. ### The connection page **Test connection** runs the test again; **Edit connection** changes the fields (secret fields stay blank: type only to replace them); **Disconnect** stops every use and deletes the secrets from the vault (the history stays in the audit trail). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/9jWMd-TZpH7uZ1f78L9Dg_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Uses of this connection**: one switch per use. For example, Microsoft Entra ID connected once serves sign-in, directory import, publishing the agent to Intune, e-mail through Microsoft 365, Teams and Microsoft 365 licenses. A use that needs extra permission shows **Open consent**; after approving at the provider, confirm with **I approved at the provider**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dBqeSs_vXlXMN6ech4pkg_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Connection data** shows the values (secrets masked), who created it and the last successful test; **Health** shows the warnings of this connection. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/FbFECGSUMNGXKHyvebbir_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Connection health and history **Connection health** lists, per connection, the result of the last test: **State** (OK, Attention, Error), **What is happening**, **How to fix** and **Checked**. Problems about assets are in **Monitor › Alerts and events**, not here. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/EqChl1NdkDPNEmwNIWDxi_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} **History** shows **When**, **Who** and **What changed**: connected, edited, disconnected, use turned on or off, consent granted and tests. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2RJ47Q1otRn7rIvKxdAT9_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### Event buses Connect Apache Kafka, RabbitMQ, Azure Service Bus, AWS SNS or Google Pub/Sub and choose the **Events to publish**: alerts, device changes, audit trail, vulnerabilities, compliance, metrics, endpoint telemetry, integrity and agent events. **Only devices with this tag (optional)** limits the device events to one tag. Each event is a **CloudEvents 1.0** JSON ( type like hive.alert.opened or hive.asset.changed , sourceone/\ ), with the type also in the Kafka header, the RabbitMQ routing key, the Service Bus label and the SNS and Pub/Sub attributes. Hive writes the event in an outbox in the same transaction as the fact and delivers every few seconds; a failure is retried after 15 s, 1 min, 5 min, 15 min, 1 h, 3 h, 6 h and 12 h, then marked as failed. On the connection page, **Events published** shows **Waiting in the outbox**, **Delivered in 24 h**, **Gave up after the retries** and the last error; **Send the failed ones again** requeues them. **Test connection** publishes a hive.test event right away. Credentials: Kafka user\:password for SASL (optional); RabbitMQ user\:password and the exchange; Service Bus KeyName\:Key of a policy with Send; SNS accessKeyId\:secretAccessKey with sns\:Publish and the topic ARN; Pub/Sub the JSON key of a service account with Pub/Sub Publisher. ### Worked example: publish alerts to Kafka 1. **Catalog**, **Category** Event buses and queues, **Apache Kafka** › **Connect**. 2. **Bootstrap servers**kafka1.centralit.com.br:9093,kafka2.centralit.com.br:9093 , **Topic**hive-events , **Events to publish** Alerts and Device changes, credential hive:\ . Connect. 3. The test publishes hive.test ; the consumer sees \{"specversion":"1.0","type":"hive.test",…} . 4. When the alert "ERP CPU" opens on ERP-APP-02, the topic receives hive.alert.opened with key = the alert id. **Events published** shows "Delivered in 24 h: 1". 4. If the broker is down for an hour, events wait in the outbox and go out when it comes back; after the last retry they count in **Gave up after the retries** until you click **Send the failed ones again**. **Worked example: Workspace ONE UEM, Intune and Jamf from the catalog** 1. In **Catalog**, choose **Category** MDM. The cards Microsoft Intune, Jamf Pro and Workspace ONE UEM appear. 2. **Connect** on any of them opens **Assets › Phones and tablets › Sources without the app**, where the source is created (they do not appear as connections in Connection health or History). 3. Intune needs Microsoft Entra ID connected first: connect **Microsoft Entra ID** from the catalog with administrator consent, then pick it in the Intune source. 4. Each source imports every 6 hours; see UEM integrations: Workspace ONE, Intune and Jamf for the fields and how devices are merged. ### Worked example: a failing Teams connection 1. **Connection health** shows "NOC Teams · Error · The destination refused the authentication · Update the credential in the vault". 2. Open the connection, **Edit connection**, paste the new **Channel webhook address** and save. 3. **Test connection**: "The connection works." The row in **Connection health** returns to OK; **History **records the edit and the test with your name. ### Pitfalls and limits Viewing needs permission to read integrations; connecting, editing, testing and disconnecting need permission to administer integrations. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/JMx-CO7TeY8AqZ59ezVDo_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} For security, Hive does not call internal network or cloud-metadata addresses from the cloud. Reach internal systems (Active Directory, SCCM, GLPI on the internal network) through the **collector**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HwLG2ADJS6keEhRJiHhc7_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ITSM, service desk and CMDB tools use a token, Basic, a fixed header, OAuth 2.0 client credentials or OAuth 2.0 with a SAML assertion; the tool returns status by calling Hive's inbound route with an integration account token. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/fOArlZs6spw9QSKuK2WWU_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Connection health shows test results; it does not watch credential expiry by itself. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-7-3c-iP3CBjZJIEjDo7D_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Federation sources (SCCM, OCS, GLPI…) are tested by the collector in **Federation**, not by **Test connection**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/cluVLRZBOYA7T-kH5PpBO_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} ### Related Notification channels and on-call ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/VCVJQwaMs-K1zXw9AiATn_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ITSM tickets, CMDB and approved changes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/neIygoM2jyGNFlSAvw2rB_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Bring machines from other inventory and CMDB tools ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ZtgeD0a03Jp3s4l-jjKGw_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} UEM integrations: Workspace ONE, Intune and Jamf ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/mGRNJ72r6A7eFNF-3a1dI_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Send events to the SIEM ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/xvf-d-2Gmbs14uCkul1Rz_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} API and integration accounts ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CN_wlZW-AoRhQiLaR9tHi_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} ### Security connectors ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KE7hZJUkintNWeaL3bbsU_image.png" size="137" isUploading="false" width="1366" height="860" darkWidth="1366" darkHeight="860" showCaption="false"} Screen: Security connectors Security connectors bring data from other security tools into Hive with a read-only account: devices, findings (CVEs), identities and cloud resources. Third-party scanners (Tenable, Qualys and Rapid7 InsightVM) add their findings next to the ones Hive detects itself, so the same CVE on the same device appears once, with every source that saw it. It is in **Integrations › Security connectors**, with two tabs: **Connectors** and **Findings**. ### What you can do here **Add from catalog** a connector for Wiz, Prisma Cloud, Zscaler ZIA, Netskope, Okta, Microsoft Entra ID, Vanta, Drata, Tenable Vulnerability Management, Qualys VMDR or Rapid7 InsightVM. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/XZa3n7ABzSZjfaqsfor8t_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Generate a connector for any other tool **From OpenAPI**: pick a GET operation and map its fields. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/VFeuoDpSzVWazt2ctyEzb_image.png" size="10" isUploading="false" width="16" height="12" darkWidth="16" darkHeight="12" showCaption="false"} **Test connection**, **Run now**, or let the schedule read the tool every **Read every (minutes)** (60 by default; from 15 to 10,080). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/39Lkv5ktSf2MmyHzTNMJX_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Import file** exported by a scanner (Tenable, Qualys or Rapid7 JSON) when the tool cannot be reached from Hive. Only scanner rows have this button. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/vBxb1fNuPE3m4aZOGp5GM_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} See the **Findings** tab: each device and CVE once, with the **Sources** that reported it ( hive , tenable , qualys , rapid7 ). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/zBc-81T7uDY6nSTCR_Zpg_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Remove** a connector. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/wazw9rwRYJiG-9teinhE6_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Seeing the connectors needs integrations\:read ; adding, testing, running, importing and removing need integrations\:admin ; the **Findings** tab needs vulnerabilities\:read . ### How a connector works The definition says how to authenticate (API key, OAuth 2.0 client credentials or user and password), which GET endpoints to read, how to follow the pages and which JSON fields become a device, a finding, an identity or a cloud resource. A connector generated from OpenAPI uses **API key** or **User and password**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/euh1RgZxrNsRr5Al4khAq_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Secrets (API key, client secret, password, access and secret keys) go to the vault and never come back on the screen or in the API. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/cBeSaFZd5R8VXXQ0lTtcd_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Only GET requests are made. Hive never changes anything in the other tool. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/kwy9DTjO4oBi32Us7k-nG_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Devices are matched with the inventory by the same rules as the cloud and the hypervisors: hardware UUID, MAC, IP and name, from strongest to weakest. When two devices could be the one, it does not match. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/9zxi-Qa6iqQft3fealBvx_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} ### Worked example: connect Tenable and import its findings 1. In Tenable Vulnerability Management, create an API user with read-only access and generate its access and secret keys. 2. In Hive, open **Integrations › Security connectors** and click **Add from catalog** (needs integrations\:admin ). 3. In **Tool**, choose **Tenable Vulnerability Management**. Keep the **Base URL** https\://cloud.tenable.com , type Tenable in **Name**, paste the **Access key** and the **Secret key**, and click **Save**: "Connector saved." 4\. Click **Test connection**: the message starts with "Connection OK:". 4. Click **Run now** ("Read started."). After the read, the **Read** column of the row shows, for example, "1,430 findings imported" and, below it, "212 devices (198 in the inventory) · 1,430 findings · 0 identities · 0 cloud resources". 5. If the Tenable cloud cannot be reached from your network, export the vulnerabilities as JSON in Tenable, click **Import file** on the row, choose it in **File (.json)** and click **Import file**. 6. Open the **Findings** tab and type CVE-2024-3400 in **Search CVE or device**: the device FW-EDGE-01 shows the sources hive and tenable on a single line. ### Worked example: generate a connector from OpenAPI 1. Download the OpenAPI 3 (JSON) document of the tool, for example openapi.json of an internal asset API published on the internet. 2. Click **From OpenAPI**, paste the document in **OpenAPI document (JSON)** and click **List operations**. 3. In **GET operation**, choose /v1/devices . Hive suggests the **Items path** (for example data.items ) and lists the fields of each item. 4. In **Entity**, choose **Devices** and map **External ID** to id , **Name** to name , **Hostname** to hostname and **IP** to ip\_address . 5. Check **Name** and **Base URL** (both filled from the document: its title and its first https\:// server). In **Authentication**, keep **API key** with **API key header**X-API-Key , paste the key in **API key** and click **Save**. 6. Click **Test connection** and then **Run now**: the devices read show up in the **Read** column of the row. ### Pitfalls and limits Connectors are read-only: only GET requests, and only on the endpoints of the definition. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/TXH1A_PTZOnpoIWvPZ7TI_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} The base URL must be https\:// and public. Internal and cloud-metadata addresses are blocked (SSRF protection) unless the platform administrator allowed them. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MBfxFQFUJfsDsKjdSifZT_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Each read follows at most 50 pages per endpoint; pages beyond that are not read, so narrow the endpoint if the tool has more. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hIEdyfNd1luipTyGJk1kC_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} The OpenAPI document must be OpenAPI 3 in JSON, up to 5 MB; only its GET operations are listed. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/85aVn-WoRMtM5LpuNOU1R_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Qualys is imported from the JSON output of the host detection API only (XML is not read). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MmC6jdGB-bXBEoEqQntie_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Findings are deduplicated by device and CVE: a finding of a device that does not match the inventory is counted but does not enter the **Findings** tab. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/TKfPNYdWyGm7D3QPMHUmd_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Removing a connector removes what it imported and its secret in the vault. Nothing changes in the other tool. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NH1kK0YJQtQoYTtS-wPxW_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Related Integrations Center ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/EINAWF18o0i5rcffy57pK_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Cloud ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ku9djt_G6HuGis4JN0oH8_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### ITSM tickets, CMDB and approved changes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/t56fGNzST_YWlEAQQzWlB_image.png" size="137" isUploading="false" width="1366" height="860" darkWidth="1366" darkHeight="860" showCaption="false"} Screen: ITSM tickets, CMDB and approved changes Hive opens tickets in the service desk tool the company already uses, receives the status back, sends devices to the tool's CMDB and reads the approved changes. Everything is in **Monitor › ITSM tickets**; each tool is a connection of the Integrations Center. Hive always calls the tool's API route with POST, using a credential stored in the vault; the tool calls Hive's inbound route with an integration account token. ### What you can do here Connect ServiceNow, Jira Service Management, GLPI, Freshservice, ServiceDesk Plus, TOPdesk, Zendesk, CITSmart or the generic connector. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/9FZtkKipOxpP_XEwXKpV7_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Map severity, support groups, categories, locations and the configuration item, see a preview and test with a real ticket. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/n7rwMspaoKsNvjnrc-QXE_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Open tickets by hand or from alert rules, and follow them in **Tickets opened by Hive**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/VuF1o_CMl23XoWt-Bs5jI_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Configure the return channel so a ticket resolved in the tool resolves the alert in Hive. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Z2no87clMFWy4wRPhMFe4_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Send devices as CIs to the CMDB and read the approved changes. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Ky-Qe6GnoLL1WEr97xILg_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### Connect a tool 1. Open **Monitor › ITSM tickets**. Under **Connectors**, search the tool and click **Connect**. 2. Fill in **Instance address**, **Route to open a ticket (POST)** (comes filled for each tool) and **Integration credential**: 3\. **Fixed token (Bearer)**, **User and password (Basic)** or **Fixed header (Name: value)**; 4. **OAuth 2.0 — get the token, then POST**: the token address, **Client id** (the secret goes in the credential) and **How the client is sent to the token address**; 5\. **OAuth 2.0 with SAML assertion**: SAML issuer, integration user (NameID), audience and the signing key and certificate in PEM. 5. Type the secret in **Credential (stored in the vault)** and connect. 6. Back in **Connections**, the card shows the state, "open · in the queue · with error" counts and whether the return channel is configured. Click **Mapping and test**. ### Mapping and test On the connection page: **Severity → priority**: priority, urgency and impact for Info, Warning, Major and Critical, as the tool expects (empty = the connector default). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/RCgkZiH2wNxE-fI0g1IG-_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Support group by tag**: lines **Tag** → **Support group** (the first asset's tags; the first matching line wins) and **Group when no tag matches**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/aaHw6PUBXkv960qqyav7h_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Category by kind of rule**: metric, change, inventory state, software usage and **Default category**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ziD0093YV3OSSkl0SPo55_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} **Location and configuration item**: **Site in Hive** → **Location in the tool**, **Identify the CI by **(asset name or serial number) and **Caller (optional)**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6XXx0cLylPanw0EmcVknM_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Behavior**: **Resolve the alert when the ticket is resolved** (needs the return channel) and **Grouping window** (minutes, default 10; 0 = no grouping): repeated alerts of the same rule within the window become one ticket with all assets. **Reopen the ticket if the problem comes back**: when the same rule fires again on the same device and target within 7 days, the previous ticket is reopened in the tool (or gets a note, where the API cannot reopen) instead of a new one. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HC5wV63idxC69JnBFU-y6_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Return status**: which tool status means Resolved, Closed or Open (e.g. 6 → Resolved in ServiceNow). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/8T2fvzssUNOUmuBTfd7dt_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Click **Save mapping**; each save is a new version. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/mWpJjoo4NgdjSxyACEeLw_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} On the right, **Preview of a ticket** › **See preview** shows how a ticket would look with the last asset seen. **Test the connection** › **Test now** opens a real test ticket ("Hive connection test — you can ignore this ticket") and resolves it, step by step. ### Tickets From a rule: in the rule wizard, **Actions › Open a ticket on**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/TRYN7XVgDNcaHj1TSUdYB_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} By hand: **Open a ticket** in the header (or in an alert or asset): **Tool**, **Title**, **Description**, **Severity**, then **Open ticket**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/s-gzJCQx8ajS4JlRrxjpk_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Tickets opened by Hive** lists the tickets with filters **Status** (In the queue, Open, With error, Resolved, Closed) and **Tool**. If the tool is down, the ticket waits in the queue and is sent again (30 s, 2 min, 10 min, 30 min, then every hour, for about 2 days); the error and the fix appear under the title. **Send again** retries a ticket with error now. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/WaML7BHsQC1P-qazVzUwi_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### Return channel In **Return channel (tool → Hive)**, click **Issue token** (needs permission to administer integrations and the API). Copy the token: it is shown only once. Configure the tool to call POST /api/v1/inbound/tickets with Authorization: Bearer \ and a body like: | \{"connectionId": "\", "externalId": "INC0012345", "status": "resolved", "comment": "Disk | | -------------------------------------------------------------------------------------------------------- | | cleaned", "author": "maria"} | | ---------------------------- | Comments go to the ticket and to its alerts; a resolved or closed status resolves the alerts when **Resolve the alert when the ticket is resolved** is on. **Replace token** revokes the old token at once. ### CMDB and approved changes In the **CMDB and approved changes** panel of the connection: **Send devices to the CMDB** and **Device types sent** (Computer, Server, Switch, Printer, Smartphone). Only CIs that changed since the last run are sent; ServiceNow uses IRE (identification and reconciliation), so CIs are not duplicated. The device ↔ CI link is kept. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ZrObiZDDuav-n6WZwbmVI_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} **Read approved changes**: approved changes (scheduled or in implementation) with their window and CIs. Hive reads them by itself from ServiceNow, Freshservice, ServiceDesk Plus, GLPI, Jira Service Management, TOPdesk and SolarWinds; other tools send them to POST ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/q2qAM56l8rfKATYyQDp-S_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} | | /api/v1/inbound/changes . | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | :inlineImage[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/aYtXMR2XkMj5vUVJlJNcK_image.png" alt caption size="10" width="16" height="16"} | Sending and reading run every 10 minutes after the panel is saved once; **Sync now** and **Read** | **changes now** do it right away. The table lists each **Approved change**, its **Window** and **Devices**. While an approved change covers a device (its window with 30 minutes of slack before and after), the changes Hive sees on that device are **authorized**: they raise no change-rule or change-policy alert, and the device history shows "authorized by CHG…". An approved change is **not** a maintenance window: metric, availability and other alerts still open and notify. ### Send approved changes from any tool POST /api/v1/inbound/changes with the token of an integration account with the scope **Tickets and changes** in **Read and send** mode (the return channel token works): | \{"connectionId": "\", | | ------------------------------------------ | | "replace": false, | | ----------------- | | "items": \[\{"id": "CHG0034567", "number": "CHG0034567", "title": "Upgrade ERP database", | | ----------------------------------------------------------------------------------------- | | "state": "scheduled", "startsAt": "2026-10-24T22:00:00-03:00", "endsAt": "2026-10-25T02:00:00- | | ---------------------------------------------------------------------------------------------- | | 03:00", | | ------- | | "cis": \["SQL-PRD-01", "ERP-APP-02"], "url": "https\://tool/change/34567"}]} | | ---------------------------------------------------------------------------- | id , startsAt and endsAt are required (dates with offset, end not before start); cis are asset names or short host names; up to 500 items per call. replace: true means "this is the full list": changes of that connection missing from it are removed. The answer is \{"saved": n, "ignored": n} . ### Worked example: connect ServiceNow 1. In ServiceNow, create the integration user svc\_hive with permission to create incidents, and an API key (or use OAuth). 2. **Monitor › ITSM tickets › Connectors**, search "ServiceNow", **Connect**. **Instance address **https\://centralit.service-now\.com , keep the route /api/now/table/incident , **Integration credential** **Fixed token (Bearer)**, paste the key (for ServiceNow Hive sends it in the x-sn-apikey header). Connect. 3. **Mapping and test**: Critical → priority 1, urgency 1, impact 1; Major → 2/2/2; tag Department: Finance → group Support N2 Finance ; **Default category**Hardware ; **Return status** 6 → Resolved, 7→ Closed. **Save mapping**. 4. **See preview** with Critical and "Disk in use": title, priority 1, group and CI appear. **Test now**: "Opening and resolving work." with a link to the test ticket. 5. **Issue token**, copy it, and create in ServiceNow the Business Rule plus REST Message that posts to /api/v1/inbound/tickets (the screen lists the steps). 6. In the rule Windows servers — production · Disk C: , tick ServiceNow in **Open a ticket on**. When SRV-FILE-01 fills its disk, INC0012345 opens; if SRV-FILE-02 fills within 10 minutes, it is added to the same ticket. When the analyst resolves the incident, the alert is resolved in Hive with the comment. ### Worked example: connect GLPI 1. In GLPI, enable the REST API and create a user token for hive . 2. **Connect** GLPI: **Instance address**https\://glpi.centralit.com.br (reachable over the internet), route /apirest.php/Ticket , **Integration credentialFixed token (Bearer)** with the user token in the credential. Hive opens a GLPI session with it ( initSession ) for each call and closes it afterwards. 3. **Return status** 5 → Resolved, 6 → Closed; **Save mapping**; **Test now**. 3. **Issue token** and configure the GLPI Webhook plugin to post to the inbound route. 4. Turn on **Send devices to the CMDB** with Computer and Server: Hive looks for the computer by serial in GLPI before creating it. ### Worked example: an approved change during the ERP upgrade 1. The change CHG0034567 "Upgrade ERP database" is approved in ServiceNow for Saturday 22:00 to 02:00, with CIs SQL-PRD-01 and ERP-APP-02. With **Read approved changes** on, it appears in the table within 10 minutes (or click **Read changes now**), with the "in the window" tag during the window. 2. Saturday 22:40 the DBA installs a new SQL Server build and stops the SQL Server Agent service. The software and service changes on SQL-PRD-01 are recorded as "authorized by CHG0034567": no change alert opens. 3. To also hold the metric and service alerts during the work, schedule in **Monitor › Alert rules ›Maintenance windows** a window **Once**, Saturday 22:00 to Sunday 02:00, **Devices** SQL-PRD-01 and ERP-APP-02. Detections inside it are only recorded as occurrences. 4. A tool Hive does not read by itself (for example TOPdesk without access) can send the same change with POST /api/v1/inbound/changes as shown above. ### Pitfalls and limits Screens need permission to read integrations; connecting, mapping, testing and **Send again **need permission to administer integrations. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/N7Qui0qDUQv-wdY-3Qze9_image.png" size="10" isUploading="false" width="16" height="12" darkWidth="16" darkHeight="12" showCaption="false"} Only the connectors of the first wave can be connected from this screen; the others show the phase when they arrive. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/pKU_htQ9slFoEjG4sodym_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} The test ticket does not appear in **Tickets opened by Hive**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dUt3xQsZXOuWict38HYwD_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Resolving the alert in Hive only adds a comment to the ticket; it does not resolve the ticket. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HCTMwDBcSA3SrC592AbsI_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} The generic connector replaces the markers , , , ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/4EHdvgoAPljxwD5YqfV_4_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} , , and in the body. Hive does not call internal addresses from the cloud; the tool must be reachable over the internet. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1sNUN-AgTsm0DbgpTl9ga_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} ### Related Integrations Center ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MWhRcycSwE_rGx9aRZgCc_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Alerts, rules and monitoring templates ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bAfIeHIHreX9N1HWzhM-Q_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} API and integration accounts ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/GKGBJpqR2F5OcHVicC8jq_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Bring machines from other inventory and CMDB tools ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/BiamvAYZvgfT7sjc6NULz_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Ticket automation ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/0q0QycLqaSTrGzETKBNTI_image.png" size="137" isUploading="false" width="1366" height="860" darkWidth="1366" darkHeight="860" showCaption="false"} Screen: Ticket automation (1/2) ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/87cPA8bnPGu6CgVSWAkRY_image.png" size="137" isUploading="false" width="1366" height="860" darkWidth="1366" darkHeight="860" showCaption="false"} Screen: Ticket automation (2/2) **Automation** acts by itself on the items of the screens that have the **Open ticket** button. You pick the screen, the conditions and the actions: **Open a ticket** in a connected ITSM tool, **Notify channels** (e-mail, Microsoft Teams, Slack, webhook, Telegram, WhatsApp, SMS or whoever is on call), or both. From then on every item that matches gets the ticket and/or the message, with no one clicking. It is in **Integrations › Automation**. The ticket is the same one the **Open ticket** button of that screen opens: the vulnerability ticket lists the CVE, the affected assets, the due date and the fix; the insight ticket carries the evidence; the license recovery marks the installations as in recovery. The ticket stays linked to the item, so the ticket list, the return from the tool and the screen itself show it. The message goes through the same channels the alert rules use (**Monitor › Notification channels**), with a link that opens the item in Hive. ### What you can do here See the rules with the screen, the **Actions** (the ITSM connection and/or how many destinations are notified), the limits, the **Last check** (items matched, tickets opened, items notified) and what the rule did **In 24 h**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6AYK6G-Q-eJMvBXrOal0B_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} Turn a rule on or off with the switch, **Run now** to check it without waiting, **Edit** or **Delete** it (needs integrations\:admin ). Deleting a rule keeps the tickets it opened. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/atkpPnVXhQVAMPoZCFvvx_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Open the **History** tab: every automatic ticket and every message with the rule, the item, the ticket (with the link to the tool) or the channel, and the **Result** (with the error when a channel refused it). Filter by rule. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/W9XFJpcul0TW_zKzc20eA_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Use **Automate…** next to the **Open ticket** button (alerts, vulnerability, asset, insights, license recovery, AI recommendation) or in the header of **Cloud posture**, **External surface**, **Identities**, ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CGFV7JAmLp4jyNgyADnMo_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} **Attack paths** and **Detection and hunting**: the wizard opens with that screen already chosen. Reading the rules and the history needs integrations\:read ; creating, changing and running them needs integrations\:admin . ### The screens a rule can watch | **Screen** | **One ticket or message per** | **Conditions** | | ------------------------------- | -------------------------------------------------------------------------- | ----------------------------------------------------- | | **Alerts** | open, acknowledged or flapping alert (not suppressed, not in maintenance) | severity, rule type, state, text, age, scope | | **Vulnerabilities** | CVE (all affected assets in one ticket; accepted risks are left out) | severity, KEV only, EPSS, text, age, scope | | **Assets** | active asset | criticality, state, text, days without contact, scope | | **Insights** | open insight without a ticket | severity, KEV, EPSS, text, age, scope | | **License recovery** | product with idle installations | product, text, scope | | **AI**
**recommendations** | new or in review recommendation | urgency, kind, state, text, age | | **Cloud posture** | open finding | severity, rule, text, age | | **External surface** | finding (expired certificate, exposed admin port, dangling DNS...) | severity, type, text | | **Identities** | identity finding (admin without MFA, stale account, old key, SoD conflict) | severity, code, text | | **Attack paths** | choke point | kind, text, scope | | **Detections** | open EDR detection | severity, ATT\&CK technique, state, text, age, scope | **Scope** is tags, groups, sites and asset types: the item matches when at least one of its assets is inside every scope field you filled. ### Step by step 1. Open **Integrations › Automation** and click **New rule** (or **Automate…** on the screen you want to automate). 2. **Screen**: pick the card of the screen whose items the rule watches. 3. **Conditions**: fill only what must be true; empty fields do not filter. All filled conditions must be true at the same time. 4. **Actions**: tick **Open a ticket**, **Notify channels** or both. For the ticket, choose the **ITSM** **connection** (connect one in **Integrations › ITSM** first) and, if you want, the **Ticket title**, **Ticket description**, **Ticket severity**, **Priority**, **Urgency**, **Impact**, **Assignment group** and **Category **(they override the mapping of the connection only for this rule). For the message, tick the **Channels** (create them in **Monitor › Notification channels**), optionally an **On-call schedule** (the person on call, or the next in line, gets an e-mail through the schedule's channel), the **Message** **title**, the **Message** and the **Quiet hours**. Titles and texts can use the placeholders , , , , , , , , and ; empty fields keep the text of the **Open ticket** button (ticket) or a standard message (notification). 5. **Name and limits**: type the **Rule name**, set **Per hour (at most)**, **Per day (at most)** and **Days before acting again on the same item**. 6. **Preview and save**: Hive lists the items that match now and what the rule would do with each one: for the ticket **Would open**, **Already has a ticket**, **Waiting** or **Over the limit**; for the message **Would notify**, **Waiting**, **Quiet hours** or **Over the limit**, with the list of destinations (**Would notify: ...**). Nothing is opened or sent in this step. Click **Save rule**. 7. The rule is checked every 5 minutes, and a few seconds after a new alert or a new vulnerability. Follow the tickets and messages in **History** or in **Integrations › ITSM**. **Worked example: e-mail the security team and post in Teams for KEV vulnerabilities on servers, without a ticket** The security team wants to know right away when a CVE that is being exploited (CISA KEV) shows up on a production server. They do not want a ticket for it, only an e-mail to the team mailbox and a post in the SOC channel of Teams, and nothing at night except critical ones. 1. In **Monitor › Notification channels** the team already has two channels: E-mail Security (SMTP, to security\@acme.example ) and Teams SOC (incoming webhook of the SOC channel). Both were tested with **Send test**. 2. Carla opens **Integrations › Automation** and clicks **New rule**. 3. **Screen**: **Vulnerabilities**. **Next**. 4. **Conditions**: **Severity at least** = **High**; she turns on **Only CVEs in the CISA KEV catalog**; under **Scope (assets)** she ticks the asset type server and types the tag prod . **Next**. 5. **Actions**: she leaves **Open a ticket** unticked and ticks **Notify channels**. Under **Channels** she ticks E-mail Security and Teams SOC . **Message title** = \[KEV] on servers . **Message** = . Servers: . Patch within 48 hours.**Quiet hours** from 22:00 to 07:00 , **Time zone**America/Sao\_Paulo , and she ticks **Critical items notify even in quiet hours**. **Next**. 6. **Name and limits**: **Rule name** = KEV on servers - notify . Limits: 10 per hour, 30 per day, 7 days before acting again on the same item. **Next**. 7. **Preview and save** shows 3 match and 10 notifications fit the limits now , with the line **Would notify: E-mail Security, Teams SOC** and three CVEs as **Would notify**. No ticket column result appears, because the rule does not open tickets. She clicks **Save rule**. 8. Within five minutes the mailbox receives three e-mails with the subject \[Hive] MAJOR \[KEV] CVE-2026-21001 on 2 servers (or **CRITICAL**), and the Teams channel shows the same three posts, each with **Open in Hive**, which opens the CVE page. **History** shows six lines **Notified**: one per CVE and per channel. 9. At 23:40 a new high KEV CVE shows up: the preview of the rule would show it as **Quiet hours**, and it is sent at 07:00. A critical one at the same time goes out at once. The three earlier CVEs are not notified again for seven days. To also open a ticket for the same items, edit the rule and tick **Open a ticket** too: the ticket and the message are counted and deduplicated separately. ### Pitfalls and limits **One open ticket per item.** If the item already has an open ticket on the same connection (opened by hand, by an alert rule or by another automation rule), the rule does not open another one: the result is **Already has a ticket**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/3a2c1eR59Xz2NMDz5gXsA_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} **One message per item in the waiting period.** After the rule notified an item, it does not notify it again during the **Days before acting again on the same item**, even if the item is still there. A rule that notifies needs at least 1 day. For tickets, 0 opens again as soon as the ticket is closed. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HP4rNGIbZDVJD1FCttzID_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Limits are counted separately.Per hour** and **Per day** count tickets and notified items apart: a rule with both actions and 10 per hour can open 10 tickets and notify 10 items in the same hour. A notified item counts once, whatever the number of channels. Items over the limit are only counted as **Over the limit**; they are handled on a later check, when the limit has room again. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/drjejDiib4gfhGMKDNr3s_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Quiet hours hold the message, not the ticket.** Inside the window the message waits (nothing is recorded, nothing counts in the limits) and goes out on the first check after the window. Tickets are opened at any time. Alert rules have no quiet hours of their own; this window is the same idea as the quiet hours of the push notifications on the phone. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HXvWurIufaDlPTtSnnDep_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Channel errors.** Each channel is tried on its own: if one fails and another delivers, the item counts as notified and the history shows the failed channel with the reason. If every destination fails, the rule tries the item again after an hour. A deleted channel shows Channel no longer exists. in the history. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/wBepZgc0MDG_kG7NuDTki_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **On call.** The person on call gets the message by e-mail through the e-mail channel of the schedule, like the alert escalation. Without a channel or without a person with e-mail, the history shows the reason. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ZNxYq5Yj2VzKb9d14HoQ8_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Message language.** The labels (severity, **Open in Hive**) follow the default language of the company, as in the alert messages; the titles and texts you type are sent as they are. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/El_wFkKVQVEaqlF8m3wqp_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Vulnerability tickets and messages are per CVE.** The scope decides whether the CVE matches (at least one asset in the scope), but the ticket and the message list every affected asset, as the **Open ticket** button does. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hEzvFg91Ha2kw9bwrkJ99_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **License recovery changes state.** Like the button, the automatic ticket marks the idle installations as in recovery; a message alone changes nothing. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/egiIDvZ6IWW0tnd0qnZHo_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **AI recommendations are not approved.** The rule opens the ticket or sends the message; approving or rejecting is still a decision of a person. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lfzASIUnc0iIOBd9seI3M_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Assets need a condition.** A rule on **Assets** without any condition is refused, because every asset would get a ticket or a message. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nAu3V0I0S5Bg8S6KaaaNf_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Failure.** If the tool refuses the ticket, the history shows **Failed** with the reason and the rule tries the same item again after an hour. A ticket that is accepted but not yet sent follows the normal retry of the ITSM queue. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/c_sWmgTMjmRIw_fe162bV_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Checks.** Rules run every 5 minutes; alerts and new vulnerabilities trigger a check in seconds. Other screens are only checked by the 5-minute cycle. Each check reads at most 2000 items per screen. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6Dd12w6WVeFI3IHk4vI1e_image.png" size="10" isUploading="false" width="16" height="12" darkWidth="16" darkHeight="12" showCaption="false"} ### Related ITSM tickets, CMDB and approved changes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/eK_8gi_Eo_96VO4ZwvJml_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_S2V_h5IB5y0snZ325Jwx_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Alerts ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/gYXNcNy0ToKs5h_WWG3cR_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Insights ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/S2UAWXvX-alaOARk3ipyS_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Integrations center ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nXiBd34wdw6iBx7EZVJZh_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### Bring machines from other inventory and CMDB tools ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/IAdY41jyxhGJ4wf9lz0-x_image.png" size="137" isUploading="false" width="1366" height="860" showCaption="false"} Screen: Bring machines from other inventory and CMDB tools Hive reads the machines that other inventory and CMDB tools already know and puts them in the inventory, matched to the assets you have. Sources: Microsoft SCCM/MECM (AdminService), OCS Inventory NG, Quest KACE SMA, ServiceNow CMDB, GLPI, Snipe-IT, ManageEngine Endpoint Central, Lansweeper, Ivanti Neurons or Endpoint Manager, Tanium, BMC Helix Discovery or CMDB, and another Hive. The reading is done by a **collector** in the network of the tool, so the tool does not need to be published on the internet. The sources are managed in **Integrations › Integrations Center ›** **Federation**. ### What you can do here Connect an inventory or CMDB tool and test it through the collector. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CAxROBOJAUQLR1oczZJQv_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Read now or every 1, 6, 12, 24, 48 or 168 hours. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/uZ_mydwCNiwk3mgPZ7ICB_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Decide who wins when sources disagree: source **Priority** and **Rules per field**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/a2W3Ub7PD7HLlNLfvgrQj_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} See the **Conflicts between sources** and, on each asset, the **Sources** tab. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-3Rg5oKI-LRY458qWWrX9_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/DPOR8cYzT7tiiU5SOoHQR_image.png" size="60" isUploading="false" width="596" height="48" darkWidth="596" darkHeight="48" showCaption="false"} ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/J4q3h3b71Rc_PktKzi_6m_image.png" size="73" isUploading="false" width="728" height="48" darkWidth="728" darkHeight="48" showCaption="false"} ### Step by step 1. **Connect.** In **Integrations Center › Catalog**, choose the **Category** Inventory and CMDB and click **Connect** on the tool. Fill in **Address of the tool**, the user (when the tool asks) and the password or token (it goes to the vault). 2. **Test.** In the **Federation** tab, click **Test** on the source: the collector reaches the tool and reads one machine ("\ answered: the collector reached the tool and read a machine."). 3. **Read.** Click **Read now**. The **Last read** column shows Reading, then Read with the number of machines, or Failed with the error and the fix. 4. **Schedule.** In **Read every**, choose 1, 6, 12, 24, 48 or 168 h (default 6). 5. **Priority.** Type a number from 1 to 1000 in **Priority** (default 50); the lower number wins. 6. **Rules per field** (optional): **Add rule**, choose the field (Name, FQDN, Serial number, Hardware UUID, Manufacturer, Model, Operating system, OS version, Main user), the source and a priority, then **Save rules**. ### How a machine becomes an asset First by the link already known (the id in that tool). Then by the same matching the agent uses: hardware UUID, serial number, network card (MAC) and name. When two assets could be the one, nothing is linked. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/TR9snFwomb9oAEaw3MBrf_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} A machine no asset matches becomes a new asset, with the source shown. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/U8UkDn9jyg0i09_0Wzxbl_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} A machine that disappears from a complete read loses the link and the values of that source; the asset stays. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/s2En6YXXF818VTVCj1cis_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Who wins **Precedence: agent (0) › field rules › source priority.** On machines with an active agent, values seen by the agent are kept. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dArBm24rjMOkc6uOaocKz_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Between tools, the lowest priority wins: the field rule's priority for that field, otherwise the source's priority. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lcnofDQAxxg4YhzYvtlTs_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Name and user are compared without domain and case, so "SRV01" and "srv01.corp.local" do not count as a conflict. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hpftzQEngAXVBCaGvwiNN_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} **Conflicts between sources** lists **Asset**, **Field**, **Value in the asset** and **What each source says**. The asset's **Sources** tab (Management group) shows, field by field, the value in use, **Provided by **and what each source says, with its priority. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/z8XLX4CYw2q8uoXW6qcyj_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} ### Links the discovery does not see Another tool can declare where a machine is connected when Hive does not read the switch or the hypervisor (needs write access to assets): PUT /api/v1/assets//switch-port with switchRef (id, name or serial of the switch), port (e.g. Gi1/0/12) or ifIndex , and optional vlan . PUT /api/v1/assets//host with hostRef (the host of a VM). The link enters the maps, the alert dependencies and the service path. What discovery observes wins: a port read by SNMP in the last day refuses the declaration, and the host read from the hypervisor comes first. DELETE on the same route removes the declared link. **Worked example: SCCM as the main source, Snipe-IT for the model** Central IT has 1,200 machines in SCCM and the asset management team keeps the official model in Snipe-IT. 1. Install a collector in the data center (see Step by step: create a collector). 2. **Catalog › Microsoft SCCM / MECM (AdminService) › Connect**: address https\://sccm01.corp.local , account CORP\svc-hive-read , password. Connect. 3. **Catalog › Snipe-IT › Connect**: address https\://assets.centralit.com.br , API token. 4. **Federation**: **Test** on SCCM ("SCCM answered…"), then **Read now**: "SCCM read: 1,200 machines applied to the inventory." 1,050 matched existing assets by UUID, serial or MAC; 150 became new assets with the source SCCM. 5. Set SCCM **Priority**10 and Snipe-IT 20 . **Rules per field** › **Add rule**: **Model** → Snipe-IT, priority 1 . **Save rules**: "Rules saved; the assets were evaluated again." 6\. Open NB-FIN-044 › **Sources**: **Model** "Latitude 5440" provided by Snipe-IT (priority 1), while SCCM says "Latitude 5440 (0C08)". **Operating system** comes from the agent (priority 0). 6. **Conflicts between sources** shows 37 machines where SCCM and Snipe-IT disagree on the serial number; the team fixes them in Snipe-IT and the next read clears them. ### Worked example: declare the switch port of a printer The printer PRN-3F-01 is on a switch Hive does not read by SNMP. | PUT /api/v1/assets/\/switch-port | | -------------------------------------------- | | \{"switchRef": "SW-ACCESS-3F", "port": "Gi1/0/12", "vlan": 30} | | -------------------------------------------------------------- | The printer appears under SW-ACCESS-3F in the network map, and an outage of the switch groups the printer's alert under it. If SNMP later reads the switch, the observed port replaces the declared one. ### Pitfalls and limits Reading needs an online collector (seen in the last 30 minutes) that reaches the tool; without one: "No collector is online to reach this tool." ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/pcZyRBNaTVwvkpd1Is-0v_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Test connection** on the connection page only checks the fields; the real test is **Test** in **Federation**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/z8heVmMHF3s6ya7LhdNUb_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Viewing needs permission to read integrations; changing priorities, rules and reading need permission to administer integrations. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1FMZb-6HjqSxH29DW0jP5_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Workspace ONE, Intune and Jamf are not federation sources; see UEM integrations. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MsUHooAaHdRFUaRd04Gcg_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Related Integrations Center ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bbFTe_8gbSejIbsYwMUcc_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Assets and inventory ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/qILTgk0LoNklowpWH0lor_image.png" size="10" isUploading="false" width="16" height="12" darkWidth="16" darkHeight="12" showCaption="false"} UEM integrations: Workspace ONE, Intune and Jamf ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1bcUiUoc8DuXoSKM1x7ag_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Populate your CMDB in 3 steps ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/DHPeFt8-Nzdy_7KwSivgc_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### UEM integrations: Workspace ONE, Intune and Jamf ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/K2dKmLDEz-DqgXQx6CDfW_image.png" size="137" isUploading="false" width="1366" height="860" darkWidth="1366" darkHeight="860" showCaption="false"} Screen: UEM integrations: Workspace ONE, Intune and Jamf Devices managed in **Workspace ONE UEM**, **Microsoft Intune** or **Jamf Pro** come into the Hive inventory without installing anything: Hive reads them directly from the cloud API of the tool, read only, and merges them with the assets you already have. The sources are created in **Assets › Phones and tablets › Sources without the app**; the MDM cards of **Integrations › Integrations Center › Catalog **open the same place. ### What you can do here Connect a Workspace ONE UEM, Intune or Jamf Pro source, test it and import now. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/YJf_QUssNMuql8_x7qgpk_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} See devices, their compliance, encryption and jailbreak/root state on the asset. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/47MUrPAu_ImmZ2sJoSYwI_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Remove a source (the devices stay in the inventory). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/r94sMp08Oy2h5JywNNoqr_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Step by step 1. Open **Assets › Phones and tablets** and go to **Sources without the app**. 2. Choose the **Source** (Microsoft Intune, Jamf Pro or Workspace ONE UEM), type a **Name** and fill in the fields of that tool (below). Secrets go to the vault. 3. Click **Connect**: "Source connected. Import it now or wait for the next round." 4\. On the source row, **Test** answers "Connection OK: devices in the source."; **Import now **imports right away; **Remove** deletes the source. 4. After that, each source is imported every 6 hours. The row shows " devices ( new)" or "never imported". ### What is imported and how it merges | | **Workspace ONE UEM** | **Microsoft Intune** | **Jamf Pro** | | -------- | ------------------------------------------------------------------------------ | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Identity | name, host name (computers),
serial, UDID (as hardware UUID on Macs), MAC | name, serial, Wi-Fi and Ethernet MAC | computers: name, serial, UDID as
hardware UUID, MACs, last IP; mobile: name, serial, Wi-Fi MAC | | System | OS family and version, model, manufacturer | OS and version,
manufacturer, model | macOS, iOS, iPadOS or tvOS and version, model | | User | e-mail, else user name | user principal name | e-mail, else user name | | Posture | compliant, encrypted, compromised, ownership, IMEI, enrollment, last sync | compliance state,
encrypted, jailbroken, last sync | encrypted, screen lock, jailbroken (mobile), last contact | | Apps | optional ("Also import the installed apps") | no | no | How a device becomes an asset: It is matched like the agent does: hardware UUID, then serial number, then network card (MAC), then name. IMEI is not used to match. Phones without a host name match by serial or MAC only. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/r8jlK7Nd3vMLRhRuFa1IF_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} A device that matches nothing becomes a new asset of the right kind (phone, tablet, notebook, computer, TV, Chromebook). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/fSs1zxOdbI2wGBWYUM4I8_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **The source only fills empty fields.** What is already on the asset — from the agent or from anything else — is never overwritten; differences are kept. The only exception is a name that is empty or an IP address. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CaZXtU1wfSDBAa0-87gE6_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} The posture (compliance, encryption, jailbreak) is replaced at each import; with two sources on the same device, the last one imported wins. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/7U8gZHiI6eWBaXcdMaXOP_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Apps from Workspace ONE count only on devices without an active agent. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lv1ARoZWJSE4zpsfhpZCy_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} UEM sources are not federation sources: they have no priority and no field rules. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/VcuMPmsuCa5ju28aieaoa_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Worked example: Workspace ONE UEM with an OAuth client 1. In Workspace ONE: **Groups & Settings › Configurations › OAuth Client Management**, create the client hive-read with a role that only reads devices; copy the Client ID and secret. Note the **REST API URL** in **Site URLs** (for example https\://as1234.awmdm.com ). 2. In Hive, **Sources without the app**: **Source** Workspace ONE UEM, **Name**WS1 Central IT , **Workspace ONE API server**https\://as1234.awmdm.com , **Authentication** OAuth client (recommended), **Region of the token address** North America, **Client ID** and **Client secret**. Leave **Also import the installed apps** off. 3. **Connect**, then **Test**: "Connection OK: 860 devices in the source." 4\. **Import now**: "860 devices (610 new)". 250 matched assets that already had the agent (Windows notebooks) by serial or MAC; their names, OS and user stay as the agent reported, and the asset gains the Workspace ONE compliance and IMEI. 4. If the company uses user and password instead: **Authentication** User and password with the tenant code, **Administrator with API access**, **Password** and **Tenant code (REST API key)**. ### Worked example: Intune through Microsoft Entra ID 1. Connect **Microsoft Entra ID** in the Integrations Center with administrator consent (the consent includes reading Intune managed devices). 2. **Sources without the app**: **Source** Microsoft Intune, **Name**Intune , **Microsoft Entra ID connection** the Entra connection. Without one, the screen says "Intune needs Microsoft Entra ID connected with the administrator consent." with **Connect Entra ID**. 3. **Connect** and **Import now**: 1,420 devices, Windows notebooks matched to the agent assets by serial; 380 iPhones and Android phones created as new assets with their compliance state. 4. A phone that is "Not compliant in Intune" shows it in its security data; build a dynamic group or a report on it. 4. Publishing the Hive agent to Intune is a different use of the same Entra connection, done in the agent wizard. ### Worked example: Jamf Pro for Macs and iPads 1. In Jamf Pro: **Settings › API roles and clients**, create a role with read privileges for computers and mobile devices and an API client hive with that role; copy the client ID and secret. 2. **Sources without the app**: **Source** Jamf Pro, **Jamf Pro address**https\://centralit.jamfcloud.com , **API client ID**, **Client secret**. **Connect**. 3. **Import now**: 140 Macs and 60 iPads. The Macs with the Hive agent match by hardware UUID (Jamf UDID); the iPads become new tablet assets with encryption, screen lock and jailbreak state. ### Pitfalls and limits Creating, testing, importing and removing need permission to administer integrations; listing needs permission to read assets. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/z1uqct0HoyDKyxaC15veT_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Hive calls the cloud API directly, not through the collector: on-premises consoles on internal addresses are not reached from the cloud. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6Vq1xZ2Ehc-U4f1TomJcA_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} The interval (6 hours) is fixed; use **Import now** for an immediate import. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ULeCIAQvtFgbS-TFCADne_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Up to 100,000 devices per source. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KigIUf31kMf2q2jbhTqOo_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} In the Integrations Center the MDM cards always show "Available": the sources live in **Phones and tablets**, not in Connection health or History. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/eY2kDdM7tuypW7j5Ck_Hp_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Related Phones and tablets (Hive Mobile) ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/oItBWQWPnw1CitgEJPJ0z_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Integrations Center ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/euppsjNnzrk6HiZAuQ7wL_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Bring machines from other inventory and CMDB tools ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2iS-Wpoo04s5vYHjK1elv_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Assets and inventory ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/JSUdZh5Ns0lBzFl_u2iQ8_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} ### Send events to the SIEM Hive continuously sends the SIEM the same events as the event buses: alerts, device changes, the audit trail, vulnerabilities, compliance and, if you want, metrics, endpoint telemetry, integrity changes and agent events. A SIEM is a connection of **Integrations › Integrations Center › Catalog**, category **SIEM and logs**; the **Audit** screen also has a **Send to the SIEM** button that opens it. ### What you can do here Send events as Syslog/CEF, LEEF 2.0 (QRadar), Splunk HTTP Event Collector or Microsoft Sentinel (Logs Ingestion API). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/IcO0wiYayFgFvr9Pmm6yi_image.png" size="10" isUploading="false" width="16" height="12" darkWidth="16" darkHeight="12" showCaption="false"} Choose the event categories and limit device events to one tag. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/e24-tWXJ8032aGNJzHXfx_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} Test the destination with a hive.test event. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/x4I7GZLKi5tai2-0fNlOr_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Destinations **Syslog / CEF**: RFC 5424 with the message in CEF. **SIEM address (host\:port)** (default port 514) and **Transport**: TCP, TLS (recommended, with the host name checked) or UDP (datagrams cut at 8192 bytes). Works with ArcSight, Elastic, Graylog, Wazuh, Chronicle and any syslog receiver. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/qMtBtPSDQgE6rRjU2fbpb_image.png" size="10" isUploading="false" width="16" height="12" showCaption="false"} **IBM QRadar**: LEEF 2.0 over syslog. **Event collector (host\:port)** and **Transport**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CR8IqriCzJRU05h6Sg6Vd_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Splunk**: **HTTP Event Collector address** (port 8088), **Index (optional)**, **Sourcetype** (default hive\:event ) and the **HEC token** (vault). Hive posts to /services/collector/event with Authorization: Splunk \ . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/YCGETkh_N_P4ry3yiH7hV_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} **Microsoft Sentinel**: **Directory (tenant) ID**, **Application (client) ID**, **Data collection endpoint**, **Data collection rule (immutable ID)**, **Stream** (default Custom-HiveEvents\_CL ) and the **Client secret**. Create a custom table with its data collection rule and give the app the **Monitoring Metrics Publisher** role on the rule. Columns: TimeGenerated, EventId, EventType, Category, Subject, Severity, Actor, Source, Data. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KqT9frYyK6QJp8o_Gve9b_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} ### Choosing what goes In **Events to publish**, tick the categories: | **Category** | **What goes** | | --------------------------- | --------------------------------------------------------------------- | | Alerts | opened, escalated, resolved | | Device changes | new device, software, hardware, network | | Audit trail | who did what | | Vulnerabilities | opened, closed, risk changed | | Compliance | a control changed status on a device | | Device metrics | CPU, memory, disk, network, services; one event per device per report | | Endpoint telemetry | processes, command lines, file activity bursts, in batches per device | | File and registry integrity | each change, with who and whether it was expected | | Agent events | enrollment, class, refusals, self-protection, silence | **Only devices with this tag (optional)** limits the device events (changes, vulnerabilities, compliance, metrics, telemetry, integrity, agent) to the devices with that tag; alerts and the audit trail always go. Severity in CEF/LEEF: critical 10, major 8, warning 6, minor 4. ### Delivery Each event goes into an outbox in the same transaction as the fact and is sent every few seconds in batches. If the SIEM does not accept it, it is sent again after 15 s, 1 min, 5 min, 15 min, 1 h, 3 h, 6 h and 12 h, then marked as failed. **Test connection** delivers a hive.test event right away in the format of the destination; if it fails, the screen says why (address, port, transport or credential). ### Worked example: audit trail and alerts to Splunk 1. In Splunk, create an HEC token hive for the index itops . 2. **Integrations Center › Catalog**, **Category** SIEM and logs, **Splunk › Connect**. **HTTP Event Collector address**https\://splunk.centralit.com.br:8088 , **Index**itops , keep **Sourcetype **hive\:event , **Events to publish** Alerts and Audit trail, paste the token. Connect. 3. The test answers "The SIEM accepted the test event: look for type hive.test." In Splunk: index=itops sourcetype=hive\:event type=hive.test . 4. When Maria changes an alert rule, an event hive.audit.\ arrives with her name in the actor; when an alert opens, hive.alert.opened . ### Worked example: only the PCI machines to QRadar over TLS 1. **IBM QRadar › Connect**: **Event collector**qradar-ec.centralit.com.br:6514 , **Transport** TLS, **Events to publish** Device changes, Vulnerabilities and Compliance, **Only devices with this tag **PCI . 2. QRadar recognizes the log source as Hive (LEEF 2.0). 3. A port opened on POS-0012 (tag PCI ) is sent; the same change on NB-HR-07 (no tag) is not. ### Pitfalls and limits Connecting needs permission to administer integrations. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/IQAtxnMMN92oUSxaM_Exp_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} The destination must be reachable from Hive; internal addresses are not called from the cloud. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KKJ13Cba0uaHrMHBjmRJd_image.png" size="10" isUploading="false" width="16" height="16" showCaption="false"} After the last retry, failed events are kept for 14 days; delivered events are cleared after one day. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2ORE-0J3ki0cO0XtioucD_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} UDP has no delivery guarantee; prefer TLS. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/AdT6pM9hDaP8u1goBtvop_image.png" size="10" isUploading="false" width="16" height="12" darkWidth="16" darkHeight="12" showCaption="false"} ### Related Integrations Center ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/gz1e6kPqICuVEOQdIqzUB_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Audit trail ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2kqyQvYhNElEgWBz-4KjM_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"} Integrate with the GRCS ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Zszu-RUv7e6KOElcRZYmg_image.png" size="10" isUploading="false" width="16" height="16" darkWidth="16" darkHeight="16" showCaption="false"}