Integrating Cato Data with Securonix

   

       

Important:

   

   

This integration is a preview and subject to change. The certification process is underway.

Overview

Use the Securonix integration to include Cato network and security data in your existing monitoring, correlation, and investigation workflows. The native integration sends data directly from Cato to your Securonix Snypr platform, so you can analyze Cato activity alongside data from other sources in a centralized SIEM and UEBA platform. This helps your SOC correlate data, create alerts, and hunt for threats without requiring additional data collection mechanisms.

Securonix Data Sources

The Securonix integration supports two data sources:

   
•        

  Events - Generated when specific activity occurs in the network or system, such as when a policy rule is matched or a threat is detected. These records provide discrete, real-time insights into security and policy enforcement. The data is sent using Cato's event schema.

     
   
•        

  Flows - Originate as network flows (5-tuple) and are enriched with application-level information as it becomes available from Cato engines. In addition to application and user context, flows include aggregated session data such as bytes, packets, and duration, providing a complete view of network activity over time. The appStats schema represents the full set of flow fields.

     

By default, new integrations export only Events. The Flows data source can generate significantly more data than the Events data source. The exact volume depends on your traffic. You can configure multiple integrations in the CMA to send different data sources as needed.

Use Cases

Events

Sample Company uses Securonix for centralized security monitoring and user behavior analytics. As a Cato customer, it has Cato data about network activity, threats, user data, devices, and all other aspects of traffic traversing the Cato platform. The admin uses this integration to send that data directly to Securonix, where the SOC team works with it alongside their other sources.

Flows

A security analyst at Sample Company identifies a suspicious event where a user accessed a high-risk application that may be associated with data exfiltration. Using Cato events alone, the analyst can see the policy decision, user identity, and application, but not how much data was transferred or how long the session lasted.

With aggregated flow data, the analyst can view the full session context, including total bytes transferred, packet count, and session duration. This lets the analyst determine whether the activity involved minimal interaction or a large data transfer that may indicate exfiltration.

Prerequisites

   
•        

  To add a connector, you must have editor permission for Integrations (in the Resources section). For more information, see Managing Admin Roles Using RBAC.

     
   
•        

  A Securonix deployment with permission to generate a bearer token.

     
   
•        

  Your Securonix ingestion URL.

     
   
•        

  Review the prerequisites for all Cato event integrations in Getting Started with Event Integrations.

     

Creating the Securonix Integration

To send Cato data to Securonix, generate a bearer token in Securonix, confirm that the endpoint accepts data, and then create the integration in the CMA.

Step 1: Generate a Securonix Bearer Token

To generate the bearer token:

   
1.        

   Log in to your Securonix deployment.

      
   
2.        

   Generate a bearer token for ingestion and give it a descriptive name such as Cato Integration.
   For token management instructions, see the Securonix documentation.

      
   
3.        

   Copy the Bearer Token value and store it securely.

      
   
4.        

   Note your Securonix ingestion URL.

      

   

       

Note:

   

   

Securonix may display the token value only when it is created. Copy it before you leave the page. If you lose it, generate a new token and use that instead.

Step 2: Test the Endpoint with curl

Before you configure the integration in the CMA, confirm that your API key, endpoint, and index work. This helps isolate Securonix-side issues from issues with the CMA integration.

The Securonix ingestion API authenticates with the Authorization: Bearer <TOKEN> header:

curl -X POST "https://<your-ingestion-url>" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  --data '{"message":"test event from curl","event_type":"test"}'

Replace <your-ingestion-url> with your ingestion URL and <TOKEN> with the bearer token from Step 1.

A successful request returns an HTTP 2xx status. In Securonix, search for test event from curl to confirm that the document arrived.

Step 3: Create the Integration in the CMA

To create the Securonix integration:

   
1.        

   From the navigation menu, select Resources > Integrations.

      
   
2.        

   On the Configured Integrations tab, click New. The New Integration panel opens.

      
   
3.        

   Select Securonix. The Capability is set to Data Export automatically.

      
   
4.        

   In the Auth drop-down, select Bearer token authentication for Securonix.

      
   
5.        

   Enter a Name for this integration and an optional Description.

      
   
6.        

   Enter the Ingestion URL that you tested with curl above.

      
   
7.        

   Enter the Bearer Token that you generated in Securonix.

      
   
8.        

   Under Data Sources, select Events, Flows, or both.

      
   
9.        

   (Optional) Add filters to control which data is sent to Securonix, as described below.

      
   
10.        

    Click Save.

       

Refresh the Integrations page. The integration appears in the Configured Integrations table with a Connected status.

Filters

Use filters to control which Cato data is exported to Securonix. This helps reduce ingestion costs, minimize noise, and focus investigations on the data that is most relevant to specific sites, users, or regions. You can also use filters to route different subsets of data to different SIEM environments.

Use filter groups to define filters based on any Event Field or combination of fields. Conditions within each group use AND logic. OR logic is applied between groups.

   
•        

  Events Filter - Click Add Filter to define a condition, or Add Group to add a filter group.

     
   
•        

  Flows Filter - Available when Flows is selected as a data source. It follows the same logic as the Events Filter.

     

Filters that are too narrow can exclude everything without showing any error. If no data arrives in Securonix after you save the integration, check the filter configuration first.

Troubleshooting