Skip to main content

CollectorsCloud Collectors Administration Guide

Prerequisites to Configure the Box Cloud Collector

Before you configure the Box Cloud Collector you must complete the following prerequisites:

  • Ensure that the https://*.box.com service is open for communication with the Exabeam Security Operations Platform.

  • Enable two-factor authentication.

  • Obtain the application key by creating a Box app.

  • (Optional) Enable the Box shield events to collect data.

Enable Two-factor Authentication

Before you configure the Box cloud collector, you must enable two-factor authentication for the Box account. To enable two-factor authentication:

  1. Log in to the Box account by accessing https://app.box.com/account.

  2. Navigate to Account Settings > Account > Authentication.

  3. Select Require 2-step verification to protect your account. For more information, see the Box Documentation.

  4. Enter a mobile phone number to enable the two-factor authentication and click Continue.

Obtain the Application Key by Creating a Box App

Box APIs are authenticated via application keys using JSON Web Tokens (JWT) to allow server-to-server authentication. JWT uses a public key pair to verify the application's permissions. You must create a Box app to obtain the public key to use while configuring the Box cloud collector.

To create a Box app:

  1. Log in to the Box developer console.

  2. Click Create New App.

    Box-1.png

  3. Click Enterprise Integration.

  4. Select OAuth 2.0 with JWT (Server Authentication) and click Next.

  5. Specify the name SkyFormation Integration for the app and click Create App.

    Note

    Make sure to specify the app name to prevent any additional costs associated with API calls.

  6. Click View Your App.

  7. In the Application Access section, select Enterprise.

  8. To define the permissions for the application to access data: in the Application Scopes section, select the check boxes for Manage Users, Manage Groups, and Manage enterprise properties.

  9. Make sure that the options in the Advanced Features section are disabled. If enabled, these options would interfere with the authentication process.

  10. Click Save Changes.

  11. In the Add and Manage Public Keys section, click Generate a Public/Private Keypair and download a JSON configuration file.

    Box-2.png

  12. Save the JSON configuration file and copy the data. You will use this data to configure the Box cloud collector.

  13. Check that the Box Account Admin user has granted the permissions that you requested for the Box Enterprise App. The Box admin user must have the Account Admin role to grant the requested access permissions. To ensure that the user has the Account Admin role, log in to the Box account by accessing https://app.box.com/account, and navigate to the Account Details section and check the username in the Admin Contact section.

    Note

    To avoid test connection failure, ensure that you create a request to authorize the app via App Settings, and get the request approved by accessing admin console, using the Box administrator account.

Enable Box Shield Events

The Box Shield alert events provide security incident alerts such as suspicious locations, suspicious sessions, anomalous download, and malicious content. The shield alert events are produced within the enterprise event stream.

The Cloud Collector for Box consumes the enterprise event stream to collect the data from Box Shield notifications. You can configure the Box account to include shield alerts if your Box enterprise account has the Box shield events enabled. To collect this data, enable the Publish alert to Box Event Stream option while configuring the Box shield rules in the Box portal. For more information see the Box documentation.