Introduction

Integrating Thinkst Canary with Field Effect MDR allows Field Effect MDR to query your Canary dashboard for recent Canary IncidentsThis level of access to your environment enriching Field Effect MDR's monitoring fidelity, and enables ARO generation, as appropriate, based on high severity alerts.

This article walks through the following: 

• Requirements
• Integration Instructions: 
  • Setting up Thinkst Canary
  • Completing the Integration in the MDR Portal

Requirements

You will need to administrator access your organization's Thinkst Canary and Field Effect MDR environments.

Integration Instructions

The following sections walk through the process of integrating Thinkst Canary with Field Effect MDR; creating an API key in Thinkst Canary and providing it within the MDR Portal. 

Setting up Thinkst Canary

1. Log into Thinkst Canary 
2. Click on the Gear Icon (upper right) and select Global Settings. 
3. Open the API section and enable the enable API toggle. 
4. Click the + Icon and create a new API key named "Field Effect MDR".
5. Copy and store the Auth Token from your new Field Effect API. =You will need to provide this token in the MDR Portal. 

For more detailed instructions, visit Thinkst Canary's documentation on API Keys.

Completing the Integration in the MDR Portal

Log into the MDR Portal and Navigate to the Admin > Integrations page. From the Cybersecurity tab, click Add for Thinkst Canary. 

The Integration wizard will open. Provide your Thinkst Canary Domain and the API Auth Token you created in the previous section (Setting up Thinkst Canary). When ready, click Submit.

A Note on Domain Validation:

When providing your domain, it must be in one of the following formats: 

"mycompany.canary.tools" or "https://mycompany.canary.tools/"

You'll be taken back to the integrations page, and the integration card will show that the integration is connected and promoted to the top, alongside any other connected integrations. Field Effect MDR will now have access to Thinkst Canary's reporting and generate AROs when appropriate.