Integrating with KnowBe4 PhishER

Overview

You can use HTTP Ingestion to integrate Blumira with KnowBe4 PhishER and bypass the need for an on-premises Ubuntu sensor or traditional API-polling Cloud Connector. This method uses Blumira’s Cloud Ingest API, which provides a unique HTTPS endpoint where your organization can transfer structured logs.

Most Blumira editions have no limit to the number of HTTP integrations you can add. However, the following restrictions apply:

• Detect Lite, Respond Core, and SIEM Core editions have a limit of one ingestion source
• M365 Edition accounts do not include access to any HTTP logging

Reference: See additional available HTTP integrations in Blumira HTTP Ingestion.

Before you begin

Before configuring any log source for outbound HTTP log streaming, you must generate your unique ingestion credentials by doing the following:

1. In the Blumira app, navigate to Ingestion > HTTP Ingestion.
2. Click Add Ingestion Instance.
3. In the window that appears, do the following:
   1. In Vendor, select the vendor you would like to integrate with.
   2. (Optional) In Ingestion Instance Name, edit the pre-populated name.
   3. (Optional) In Description, type a description that provides context for this instance being created.
   4. Click Save.
4. In the Credentials window, do at least one of the following:
   • Copy and save each credential to use later when configuring your vendor integration.

   • Keep the Credentials window open to copy and paste the values directly from Blumira into the vendor's site in a different browser tab. 

     Important: You must copy the token before you close the window. You will not be able to see the token again after you close the Credentials window.

Configuring KnowBe4 PhishER

To integrate with KnowBe4 PhishER and start receiving logs, do the following:

1. In PhishER, navigate to Settings > Integrations > Webhook.
2. Click New Webhook.
   
3. Under Name, type a name to identify your webhook by.
4. In the URL box, paste the URL value you copied from the Credentials for KnowBe4 PhishER window in Blumira.
5. In the Authorization dropdown, select Bearer Token.
6. In the Token box, paste the Token value you copied from the Credentials for KnowBe4 PhishER window in Blumira.
7. Under Available Data, select the check boxes next to each data type you want to transfer.
   
8. Click Create.
9. Navigate to Actions > Actions List.
10. Click New Action in the top-right corner.
11. In the Action Details page that appears, do the following:
    1. In Name, type a name to identify the action by.
    2. In Description, type a description that defines the purpose of the action.
    3. Under Choose how this action should be triggered, select the trigger you want to initiate the action.
    4. Under Choose the action to be taken on matched messages, do the following:
       1. Click the check box next to each action you want to set.
       2. In the respective dropdown menu, select the desired status, priority, or category.
    5. Under Choose how you would like to report this action, do the following:
       1. Select Send to Webhook. 
       2. In the Select a Webhook dropdown menu, select the webhook you created in previous steps.
    6. (Optional) Under Choose whether or not to halt further actions, click the check box next to Stop executing further actions if you want to prevent actions ordered below this action from running.
    7. (Optional) Under Choose QuickActions settings, click the check box next to the setting you want to implement.

    8. (Optional) Under Choose whether or not to permanently delete matching messages, click the check box next to Delete matching messages from PhishER Inbox if you want to delete messages with the tags you specified in Step 3.

       Note: If you chose to trigger this action for every message, this section will be grayed out.

    9. (Optional) Under Find Similar Messages, select the check boxes next to two or more criteria and the action you want PhishER to take if a message matches that criteria.

       Note: To change the timeframe for finding similar messages, click the dropdown menu labeled with the current timeframe, and select a different option.
    10. Click Save Action.
12. (Optional) Click and drag your actions to reorder them if you chose to halt further actions, and then click Save Action Order.

For information about managing this HTTP integration and its tokens, see Using Blumira HTTP Ingestion.