Omnissa Trust Network

Omnissa Trust Network integrates threat data from security solutions including endpoint detection and response (EDR) solutions, mobile threat defense (MTD) solutions, and cloud access security brokers (CASB). This integration provides Omnissa Intelligence users with insights into the risks to devices and users in their environment. See how to register your specific Trust Network system with Intelligence.

Intelligence displays event data for analysis in the Threats Summary module on the Security Risk dashboard.

FedRAMP consideration

The NIST Special Publication 800-47 Rev.1: Managing the Security of Information Exchanges defines a system interconnection as the direct connection of two or more IT systems for the purpose of sharing data and other information resources.

Connecting IT systems is a customer configured capability. Before you connect IT systems in Omnissa Intelligence, discuss the risks of connecting non-FedRAMP accredited information systems with your Authorizing Official. Workspace ONE on AWS GovCloud, and by extension, Intelligence is a FedRAMP High, accredited information system. When you connect information systems to other systems with different security requirements and controls, carefully consider the risks.

Contact the Federal Support line (877-869-2730, OPTION 2) or submit a support request using Customer Connect for more details and to enable customer-controlled third party connections to other systems.

How do you integrate a system?

To integrate your Trust Network system, perform these general tasks.

Note: If you see no data identified in the Threats Summary after you have configured the service in Integrations, it does not mean that the configuration is broken. It can suggest that there have been no events reported from the Trust Network service.

1. In Intelligence, register the Trust Network supported service in Integrations.
2. View, analyze, and work with data in the Threats Summary module on the Security Risk dashboard.
3. In Workflows, create a workflow using Trust Network triggers to act on threat intelligence data with available actions.

Threats Summary categories for Trust Network

The Threats Summary module aggregates and displays events collected from your Trust Network services. You can find specific data by dates, event counts, and threat categories. Intelligence categorizes threats into several groups to help simplify analysis and remediation.

Threat Category Descriptions

Omnissa Workspace ONE Mobile Threat Defense

Integrate your Workspace ONE Mobile Threat Defense service with Intelligence so that Intelligence can access threat intelligence data and display it for analysis.

To register Workspace ONE Mobile Threat Defense with Intelligence, enter the application key generated from your Workspace ONE Mobile Threat Defense console.

Prerequisites

• Use the Omnissa Workspace ONE UEM console version required for Intelligence. See Required Workspace ONE UEM console version for details.
• Use Workspace One Mobile Threat Defense with the supported Workspace ONE Intelligent Hub or Lookout for Work client applications for iOS or Android.
• Integrate your Workspace One Mobile Threat Defense console with Workspace ONE UEM. For information about this integration see Integrate Workspace ONE Mobile Threat Defense with Workspace ONE UEM. You must integrate these systems before you can use threat intelligence data from the Workspace One Mobile Threat Defense console in Intelligence.

Procedure

1. Log in to the Workspace One Mobile Threat Defense console to generate a key for use in Intelligence.
   1. Go to System > Application Keys.
   2. Select Generate Key to generate an application key.
   3. Give this key a label and then copy it to your dashboard.
   4. Save the key somewhere safe because you need to enter this key in Intelligence.
2. Log in to Intelligence to authorize it to communicate with Workspace ONE Mobile Threat Defense.
   1. Go to Integrations > Data Sources > Workspace One Mobile Threat Defense > Set Up > Get Started.
      To access previously entered credentials, select the three dots (...) at the bottom right of the card and select Edit.
   2. In the Authorization Details area, enter the listed information for a successful connection.
      • Base URL - Enter the API endpoint URL for Workspace One Mobile Threat Defense, which is https://api.lookout.com.
      • Application Key - Enter the Application Key that you generated in the Workspace One Mobile Threat Defense console. This value sets the communication between Intelligence and the Workspace One Mobile Threat Defense service.
   3. To finish the configuration, select Authorize.

BETTER Mobile

Integration between Intelligence and BETTER Mobile involves copying generated data from the Intelligence console and adding it to your BETTER Mobile administrator portal. This action authorizes Intelligence to ingest threat intelligence data from BETTER Mobile and to display it for analysis.

This integration works for Android and iOS platforms.

Prerequisites

Before you can register BETTER Mobile, integrate your BETTER Mobile and your Workspace ONE UEM environments. For details, go to the BETTER Mobile site.

Use the Better MTD console 3.x or later for this integration.

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > BETTER Mobile > Set Up > Get Started.

2. Enter an email on the Network Partner Setup Details tab. If there are any connection issues between Check Point and Intelligence, the system notifies this email address.

3. In the Network Partner Credentials tab, copy the generated information and add them to your BETTER Mobile administrator portal.

   • Hostname
   • Port
   • Integration Token

4. To finish the configuration, select Done.

Carbon Black

Enter data that pertains to your Carbon Black connector for the CB Defense agent so that Intelligence can access threat intelligence data and display it for analysis.

To register Carbon Black with Intelligence, enter the keys and IDs for your Carbon Black API connector and your Carbon Black SIEM connector.

For information on how to generate API keys, subscribe to Carbon Black event notifications, and the API endpoint URL of your Carbon Black instance, access the topic API Access on the Carbon Black Developer Network site.

Privacy controls and geographic regions

Carbon Black has privacy controls in place that limit data from being forwarded outside of the region where the Carbon Black tenant is based. For a successful integration with Intelligence, ensure that the Carbon Black tenant and the Intelligence instance are both located within the same geographic region.

Find the Intelligence regions listed at Allowlisting URLs by region. The table depicts the Carbon Black regions mapped to Intelligence regions.

Examples of privacy controls

• A customer accessing the US East Carbon Black console can integrate with Intelligence instances located within the North American regions NA1, CA1, and Sandbox.
• Customers that use the Frankfurt Carbon Black console can integrate with the Intelligence instances located in the Central European regions EU1 and EU2.
• Customers that use the London Carbon Black console can integrate with the Intelligence instance located in the Western European region UK1.
• Customers that use the Tokyo Carbon Black console can integrate with the Intelligence instance located within the Northwest Asia Pacific region AP1.
• Customers that use the Sydney Carbon Black console can integrate with the Intelligence instance located within the Southeast Asia Pacific region AU1.
• As cross-regional integrations are blocked due to privacy controls, a Carbon Black tenant located in eu-central-1 is blocked from passing data to an Intelligence instance located in NA1.

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > Carbon Black > Set Up > Get Started. To access previously entered credentials, select to Edit Carbon Black.
2. In the Provide Credentials area, enter the information for a successful connection.
   • Base URL: Enter the API endpoint URL for your Carbon Black instance so that Intelligence can access it. This string begins with https://.
   • API Key - Enter the value that gives Intelligence permission to authenticate with your Carbon Black instance. This key with the ID provides access to Carbon Black APIs except notification APIs.
   • SIEM Key - Enter the value that gives Intelligence permission to send notifications and alerts to devices that are part of SIEM systems. This key provides access to all Carbon Black notification APIs.
   • API Connector ID - Enter the value that works with the API Key to authenticate with your Carbon Black instance. This ID with the key provides access to Carbon Black APIs except notification APIs.
   • SIEM Connector ID - Enter the value that works with the SIEM Key to give Intelligence access to Carbon Black APIs for notifications.
3. To finish the configuration, select Authorize.

Check Point

Integration between Intelligence and Harmony Mobile, Check Point's Mobile Threat Defense solution, involves copying generated data from Intelligence and adding it to your Check Point administrator portal. This action authorizes Intelligence to ingest threat intelligence data from Check Point and to display it for analysis.

This integration works for Android and iOS platforms.

Prerequisites

Before you can use this Trust Network integration, integrate your Check Point Harmony Mobile and your Workspace ONE UEM environments. For details, access Integration with Workspace ONE UEM.

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > Check Point > Set Up > Get Started.

2. Enter an email on the Network Partner Setup Details tab. If there are any connection issues between Check Point and Intelligence, the system notifies this email address.

3. In the Network Partner Credentials tab, copy the generated information and add them to your Harmony Mobile administrator portal in Settings > Syslog > Intelligence.

   • Hostname
   • Port
   • Integration Token

4. To finish the configuration, select Done.

Lookout for Work

Enter data that pertains to your Lookout for Work service so that Intelligence can access threat intelligence data and display it for analysis.

To register Lookout for Work with Intelligence, enter the application key configured in your Lookout for Work console.

Prerequisites

• Use Workspace ONE UEM console version required for Intelligence.
• Use the Lookout for Work client version 5.10.0 or newer for iOS or Android.

Integrate Lookout for Work and Workspace ONE UEM so that Workspace ONE UEM manages the Lookout for Work app. For information about this integration, go to the Lookout Enterprise Support site see the Deploying Lookout with AirWatch guide.

You must integrate these systems before you can use threat intelligence data from Lookout for Work in Intelligence.

As part of the integration, you add application configuration parameters to the Lookout for Work app's record in the Workspace ONE UEM console.

• Configuration Key: Get this value from the app's metadata.
• Value Type: Select String.
• Configuration Value: Enter both parameters exactly. If you misspell a parameter or add a bracket where one is not needed, the parameter does not work.
  • DeviceUniqueIdentifier
  • DeviceUUID}

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > Lookout > Set Up > Get Started. To access previously entered credentials, select to Edit Lookout for Work.
2. In the Provide Credentials area, enter the information for a successful connection.
   • Base URL - Enter the API endpoint URL for Lookout for Work, which is https://api.lookout.com.
   • Application Key - Enter the value that sets the communication between Intelligence and Lookout for Work.
3. To finish the configuration, select Authorize.

Netskope

Enter data that pertains to your Netskope instance so that Intelligence can access cloud security threat data and display it for analysis.

To register Netskope with Intelligence, enter the Netskope application key set in the Netskope console.

Prerequisites

Integrate Netskope and Workspace ONE UEM so that Workspace ONE UEM manages the Netskope app.

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > Netskope > Set Up > Get Started. To access previously entered credentials, select to Edit Netskope.
2. In the Connection Permissions area, view the data to which Intelligence wants access.
3. In the Provide Credentials area, enter the information for a successful connection.
   • Base URL - Enter the URL for Netskope so that Intelligence can access it. This string begins with https://.
   • Application Key - Enter the value that sets the communication between Intelligence and Netskope.
4. To finish the configuration, select Authorize.

Pradeo

Integration between Intelligence and Pradeo Security involves copying generated data Intelligence and adding it to your Pradeo administrator portal. This action authorizes Intelligence to ingest threat intelligence data from Pradeo Security and to display it for analysis.

This integration works for Android and iOS platforms.

Prerequisites

Before you can use this Trust Network integration, integrate your Pradeo and your Workspace ONE UEM environments. Search for the Pradeo blog article Pradeo enriches Workspace ONE with Mobile Threat Intelligence. The Pradeo Blog resides at https://blog.pradeo.com/.

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > Pradeo > Set Up > Get Started. To access previously entered credentials, select to Edit Pradeo.

2. Enter an email on the Network Partner Setup Details tab.

3. In the Network Partner Credentials tab, copy the generated information and add them to your Pradeo Security administrator portal.

   • Integration Token
   • Hostname
   • Port

4. To finish the configuration, select Done.

Wandera

Integration between Intelligence and Wandera's Mobile Threat Defense system involves copying generated data from Intelligence and adding it to your Wandera administrator portal.

This action authorizes Intelligence to ingest threat intelligence data from Wandera and to display it for analysis.

This integration works for Android and iOS platforms.

Prerequisites

Before you can use this Trust Network integration, integrate your Wandera and your Workspace ONE UEM environments. For details, use your Wandera account to search for listed articles at wandera.com.

• Integrating Threat Events Stream with Intelligence
• EMM Connect Workspace ONE Configuration Guide

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > Wandera > Set Up > Get Started. To access previously entered credentials, select to Edit Wandera.
2. Enter an email on the Network Partner Setup Details tab.
3. In the Network Partner Credentials tab, copy the generated information and add them to your Wandera administrator portal.
   • Integration Token
   • Hostname
   • Port
4. To finish the configuration, select Done.

Zimperium

Integration between Intelligence and Zimperium involves copying generated data from Intelligence and adding it to your Zimperium zConsole. This action authorizes Intelligence to ingest threat intelligence data from Zimperium and to display it for analysis.

This integration works for Android and iOS platforms.

Prerequisites

• This integration works with the minimum version of zConsole 4.28 and later.
• Use the Zimperium Support site and your Zimperium Support credentials to find integration documentation.

Procedure

1. In the Intelligence console, go to Integrations > Data Sources > Zimperium > Set Up > Get Started. To access previously entered credentials, select to dEdit Zimperium.
2. Enter an email on the Network Partner Setup Details tab.
3. In the Network Partner Credentials tab, copy the generated information and add them to your Zimperium zConsole.
   • Integration Token
   • Hostname
   • Port
4. To finish the configuration, select Done.