Creating a new connection

Before you can create a new connection we need a few prerequisites: an API Key and an Organization. For more information on these two items please review our quick start guide here. The last step of the quick start describes how to create a new connection, the POST body consists of:

vendor - The Enum of the vendor product you want to connect to.
credentials - The specific credential body for the vendor you are connecting to, this is not required for Oauth based connections.
options - (Optional) Any additional options you want to pass to the connection, each vendor has different options available.

Since creating a connection requires you to have the correct combination of vendor, credentials, and options in the correct combination we have provided examples of each below.

VMS Connections

Tenable

{
  "credentials": {
    "client_key": "<string>",
    "secret_key": "<string>"
  },
  "vendor": "TENABLE"
}

Qualys

{
  "credentials": {
      "username": "test",
      "password": "pass",
  },
  "options": { # Optional not required
      "init_load_timestamp": "2021-01-01T00:00:00+00:00", # Timestamp to start the data pull from
  },
  "vendor": "QUALYS"
}

InsightVM

{
  "credentials": {
    "base_url": "https://api.url.com",
    "api_key": "api_key"
  },
  "vendor": "INSIGHTVM"
}

MS Defender VMS

Admin consent — the customer authorizes Leen’s Microsoft Defender app. The response carries an oauth2_authorize_url to send them to.

{
  "vendor": "MS_DEFENDER_VMS",
  "options": { # Optional not required
    "oauth2_redirect_urls": { # Overried the default redirect to Leen's splash page'
      "success": "https://myapp.com/success",
      "error": "https://myapp.com/error"
    }
  }
}

Or the customer’s own app registration. All three values are required together, and the response carries no oauth2_authorize_url — the connection is active immediately.

{
  "vendor": "MS_DEFENDER_VMS",
  "credentials": {
    "tenant_id": "...",    # Directory (tenant) ID
    "client_id": "...",    # Application (client) ID
    "client_secret": "..." # the secret Value, not the Secret ID
  }
}

More info on both flows can be found here

SentinelOne VMS

{
  "credentials": {
    "base_url": "https://api.url.com",
    "api_token": "api_token"
  },
  "vendor": "SENTINELONE_VMS"
}

CrowdStrike Spotlight

{
  "credentials": {
    "client_id": "client_id",
    "client_secret": "client_secret"
  },
  "vendor": "CROWDSTRIKE_SPOTLIGHT"
}

AWS Inspector2

Direct access

{
  "credentials": {
    "aws": {
      "aws_access_key_id": "access_key_id",
      "aws_secret_access_key": "secret_key",
      "aws_region_name": "us-east-1",
      "type": "direct_access"
    }
  },
  "vendor": "AWS_INSPECTOR2"
}

Leen Role

{
  "credentials": {
    "aws": {
      "aws_role_arn": "role_arn",
      "external_id": "external_id",
      "aws_region_name": "us-east-1",
      "type": "leen_role"
    }
  },
  "vendor": "AWS_INSPECTOR2"
}

Role Chaining

{
  "credentials": {
    "aws": {
      "aws_role_arn": "role_arn",
      "external_id": "external_id",
      "aws_region_name": "us-east-1",
      "type": "role_chaining"
    }
  },
  "vendor": "AWS_INSPECTOR2"
}

Wiz VMS

{
  "credentials": {
    "base_url": "https://api.usxx.app.wiz.io",
    "client_id": "client_id",
    "client_secret": "client_secret"
  },
  "vendor": "WIZ_VMS"
}

EDR Connections

MS Defender Endpoint

Admin consent — the customer authorizes Leen’s Microsoft Defender app. The response carries an oauth2_authorize_url to send them to.

{
  "vendor": "MS_DEFENDER_ENDPOINT",
  "options": { # Optional not required
    "oauth2_redirect_urls": { # Overried the default redirect to Leen's splash page'
      "success": "https://myapp.com/success",
      "error": "https://myapp.com/error"
    }
  }
}

Or the customer’s own app registration. All three values are required together, and the response carries no oauth2_authorize_url — the connection is active immediately.

{
  "vendor": "MS_DEFENDER_ENDPOINT",
  "credentials": {
    "tenant_id": "...",    # Directory (tenant) ID
    "client_id": "...",    # Application (client) ID
    "client_secret": "..." # the secret Value, not the Secret ID
  }
}

More info on both flows can be found here

SentinelOne Endpoint

{
  "credentials": {
    "base_url": "https://api.url.com",
    "api_token": "api_token"
    },
    "vendor": "SENTINELONE"
}

CrowdStrike Falcon

{
  "credentials": {
    "client_id": "client_id",
    "client_secret": "client_secret"
  },
  "vendor": "CROWDSTRIKE"
}

AppSec Connections

Snyk

Both routes below take base_url, which selects the Snyk region. It must be one of https://app.snyk.io (US-01, the default), https://app.us.snyk.io (US-02) or https://app.eu.snyk.io (EU-01). Use the app hostname, not the API one. On the OAuth route it also decides which region the returned oauth2_authorize_url points at, so send it whenever the customer is not on US-01.OAuth — the customer authorizes Leen’s Snyk app. The response carries an oauth2_authorize_url to send them to.

{
    "vendor": "SNYK",
    "credentials": {
        "base_url": "https://app.us.snyk.io" # Optional, defaults to https://app.snyk.io
    },
    "options": { # Optional not required
        "oauth2_redirect_urls": { # Overried the default redirect to Leen's splash page'
          "success": "https://myapp.com/success",
          "error": "https://myapp.com/error"
        }
    }
}

Or a Snyk API token, from a service account with the Org Admin role. The response carries no oauth2_authorize_url — the connection is active immediately.

{
    "vendor": "SNYK",
    "credentials": {
        "api_token": "...",
        "base_url": "https://app.us.snyk.io" # Optional, defaults to https://app.snyk.io
    }
}

More info on both flows can be found here

Semgrep

{
  "vendor": "SEMGREP",
  "credentials": {
    "web_api_token": "web_api_token"
  }
}

Aikido

{
  "vendor": "AIKIDO",
  "credentials": {
    "client_id": "client_id",
    "client_secret": "client_secret",
  }
}

Wiz Code

{
  "credentials": {
    "base_url": "https://api.usxx.app.wiz.io",
    "client_id": "client_id",
    "client_secret": "client_secret"
  },
  "vendor": "WIZ_CODE"
}

Checkmarx

{
  "credentials": {
    "base_url": "https://us.ast.checkmarx.net",
    "tenant_name": "tenant-name",
    "client_id": "client_id",
    "client_secret": "client_secret"
  },
  "vendor": "CHECKMARX"
}

Mend.io

{
  "credentials": {
    "user_email": "user-email",
    "user_key": "user-key",
    "org_uuid": "org-uuid",
    "base_url": "https://api-saas.mend.io"
  }
  "vendor": "MEND"
},

IDP Connections

Okta

{
    "vendor": "OKTA",
    "credentials": {
      "org_url": "https://{your-tenant}.okta.com",
      "api_token": "api_token"
    }
}

MS Entra

OAuth2

{
  "vendor": "MS_ENTRA",
  "options": { # Optional not required
    "oauth2_redirect_urls": { # Overried the default redirect to Leen's splash page'
      "success": "https://myapp.com/success",
      "error": "https://myapp.com/error"
    }
  }
}

More info on our OAuth flow can be found here

Secret

{
  "vendor": "MS_ENTRA",
  "credentials": {
    "client_id": "client_id",
    "client_secret": "client_secret",
    "tenant_id": "tenant_id"
  }
}

TPRM Connections

Black Kite

{
  "credentials": {
    "client_id": "client_id",
    "client_secret": "client_secret"
  },
  "vendor": "BLACK_KITE"
}

BitSight

{
  "credentials": {
    "username": "<generated_api-token>"
  },
  "vendor": "BIT_SIGHT"
}

SecurityScorecard

{
  "credentials": {
    "api_key": "<generated_api-token>"
  },
  "vendor": "SECURITY_SCORECARD",
}

ProcessUnity

{
    "credentials": {
        "base_url": "https://{region}.processunity.net/{InstanceName}",
        "username": "<PU username>",
        "password": "<PU password>",
        "third_party_import_template_id": "<Int, Third Party Import Template ID>",
        "issues_import_template_id": "<Int, Issues Import Template ID>"
    },
    "vendor": "PROCESSUNITY",
    "options": {
        "connection_id": "<Leen connection id of source connection>"
    }
}

API Documentation

AppSec

EDR

VMS

CSPM

Identity Provider (IDP)

TPRM

GRC

ITSM

Entities

Configuration

Provisioning

Connectors

OnRamp

Enrichments

Outbound Jobs

VMS Connections

EDR Connections

AppSec Connections

IDP Connections

TPRM Connections

​VMS Connections

​EDR Connections

​AppSec Connections

​IDP Connections

​TPRM Connections

VMS Connections

EDR Connections

AppSec Connections

IDP Connections

TPRM Connections