What does the integration offer?
Use Compass's Evident.io Integration to forward Evident.io alerts to Compass. Compass determines the right people to notify based on on-call schedules, notifies via email, text messages (SMS), phone calls and iOS and Android push notifications, and escalates alerts until the alert is acknowledged or closed.
How does the integration work?
When a signature is created in Evident.io, an alert is created in Compass automatically through the integration.
Set up the integration
Evident.io is an API-based integration. Setting it up involves the following steps:
Add an Evident.io integration in Compass
Configure the integration in Evident.io
Add an Evident.io integration
Bidirectional integrations aren’t supported in the Standard plan. All the other integrations are supported at a team level in Standard.
If you're using the Standard plan in Compass, you can add this integration only from your team’s operations page. Adding an integration from your team’s operations page makes your team the owner of the integration. This means Compass only assigns the alerts received through this integration to your team.
To add an Evident.io integration in Compass, complete the following steps:
Go to your team’s operations page.
On the left navigation panel, select Integrations and then Add integration.
Run a search and select “Evident.io”.
On the next screen, enter a name for the integration.
Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.
Select Continue.
The integration is saved at this point.Expand the Steps to configure the integration section and copy the API URL.
You will use this URL while configuring the integration in Evident.io later.Select Turn on integration.
The rules you create for the integration will work only if you turn on the integration.
Configure the integration in Evident.io
To configure the integration of Evident.io with Compass, complete the following steps:
In Evident.io, go to Control Panel > Integrations.
Select Webhook.
Paste the API URL copied previously from Compass into URL.
Enter the maximum number of alerts that may be sent through this integration every minute into Throttle Rate.
Check the alert types and signatures to receive.
Select Submit.
Fill in the Integration Configuration form.
Select Save.
Sample webhook message from the Evident.io Plugin
JSON
{
"data": {
"id": "259835974",
"type": "alerts",
"attributes": {
"created_at": "2016-11-08T12:46:55.000Z",
"status": "pass",
"resource": "jsm-app",
"updated_at": "2016-11-09T09:45:04.000Z",
"started_at": "2016-11-08T12:46:55.000Z",
"ended_at": null
},
"relationships": {
"external_account": {
"data": {
"id": "4055",
"type": "external_accounts"
},
"links": {
"related": "https://esp.evident.io/api/v2/external_accounts/4055.json"
}
},
"region": {
"data": {
"id": "9",
"type": "regions"
},
"links": {
"related": "https://esp.evident.io/api/v2/regions/9.json"
}
},
"signature": {
"data": {
"id": "136",
"type": "signatures"
},
"links": {
"related": "https://esp.evident.io/api/v2/signatures/136.json"
}
},
"custom_signature": {
"data": null,
"links": {
"related": null
}
},
"suppression": {
"data": null,
"links": {
"related": null
}
},
"metadata": {
"data": {
"id": "258238708",
"type": "metadata"
},
"links": {
"related": "https://esp.evident.io/api/v2/alerts/259835974/metadata.json"
}
},
"cloud_trail_events": {
"data": [],
"links": {
"related": "https://esp.evident.io/api/v2/alerts/259835974/cloud_trail_events.json"
}
},
"tags": {
"data": [],
"links": {
"related": "https://esp.evident.io/api/v2/alerts/259835974/tags.json"
}
}
}
},
"included": [
{
"id": "4055",
"type": "external_accounts",
"attributes": {
"created_at": "2016-11-08T12:28:31.000Z",
"name": "Compass Development",
"updated_at": "2016-11-09T06:26:22.000Z",
"arn": "arn:aws:iam::729181177740:role/Evident-Service-Role",
"account": "729181177740",
"external_id": "960f0836-b71f-45d3-a54f-4cf1608804c7",
"cloudtrail_name": null
},
"relationships": {
"organization": {
"links": {
"related": "https://esp.evident.io/api/v2/organizations/1874.json"
}
},
"sub_organization": {
"links": {
"related": "https://esp.evident.io/api/v2/sub_organizations/3426.json"
}
},
"team": {
"links": {
"related": "https://esp.evident.io/api/v2/teams/4000.json"
}
},
"scan_intervals": {
"links": {
"related": "https://esp.evident.io/api/v2/external_accounts/4055/scan_intervals.json"
}
}
}
},
{
"id": "9",
"type": "regions",
"attributes": {
"code": "global",
"created_at": "2014-06-05T23:42:37.000Z",
"updated_at": "2014-06-05T23:42:37.000Z"
}
},
{
"id": "136",
"type": "signatures",
"attributes": {
"created_at": "2016-09-07T16:30:14.000Z",
"description": "\"IAM users can access AWS resources using different types of credentials, such as passwords or access keys. Best security practice is to remove or deactivate any credentials that have been unused in the last 90 days. Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used. This signature scans for any such incidents and generates a report if one is discovered.\"",
"identifier": "AWS:IAM-014",
"name": "Unused IAM User Credentials",
"resolution": "\"To resolve this alert:Open the AWS IAM Console. Go to Users, select the user identified in the alert.Select the Security Credentials tab.Click Manage Password.Click Remove Existing Password to prevent the user from logging in until their credentials can be verified.For more information: see AWS: IAM documentation.\"",
"risk_level": "Low",
"updated_at": "2016-11-01T17:17:43.000Z"
},
"relationships": {
"service": {
"links": {
"related": "https://esp.evident.io/api/v2/services/4.json"
}
}
}
},
{
"id": "258238708",
"type": "metadata",
"attributes": {
"data": {
"details": {
"arn": "arn:aws:iam::729181177740:user/jsm-app",
"message": "User has logged in in the past 90 days",
"username": "jsm-app"
}
}
}
}
]
}