Supported Fields

Leen.dev Unified API for Security

API Reference

Support

Information about the EDR integrations available in Leen. Find out which fields are supported by each integration and how to configure them.

EDR Integrations

Introduction

Quick Start

Information about the VMS integrations available in Leen. Find out which fields are supported by each integration and how to configure them.

VMS Integrations

Information about the AppSec integrations available in Leen. Find out which fields are supported by each integration and how to configure them.

AppSec Integrations

Information about the CSPM integrations available in Leen. Find out which fields are supported by each integration and how to configure them.

CSPM Integrations

Authentication

Due to a limitation in our docs it has become confusing to figure out how to create a new connection. This guide will help you through the process.

Creating a new connection

Supported AppSec connectors for the AppSec endpoints

AppSec Connectors

List all the issues for a given connection. sort - supports `severity:asc` (eg. lowest to highest criticality) and `severity:desc` if not direction is provided it will default to `asc`

List Issues

Retrieve an issue by its ID (Leen's UUID).

Get Issue by ID

Supported EDR connectors for the EDR endpoints

EDR Connectors

List all the EDR alerts for a given connection.

List Alerts

Retrieve an EDR alert by its ID (Leen's UUID).

Get Alert by ID

List all the device policies for a given connection.

List Policies

Supported VMS connectors for the VMS endpoints

VMS Connectors

List all the vulnerabilities for a given connection.

List Vulnerabilities

Retrieve a vulnerability by its ID (Leen's UUID)

Get Vulnerability by ID

List VMS Scan Configurations

Get VMS Scan Configuration by ID

Supported CSPM connectors for the CSPM endpoints

CSPM Connectors

List Compliance Findings

Supported Device connectors for the Device endpoints and model properties

Device Connectors

List all the devices for a given connection.

List Devices

Retrieve a device by its ID (Leen's UUID).

Get Device by ID

List all the device groups for a given connection.

List Device Groups

Supported Configuration connectors for the Configuration endpoints

Configuration Connectors

List all users who have access to the connection source (e.g. Tenable, Qualys, etc.)

List Configuration Users

Return a User who has access to a connection source by ID (Leen's UUID).

Get Configuration User by ID

Create an organization for a given Account.

Create Organization

List all the organizations for a given Account.

List Organizations

Return an organization by its ID (Leen's UUID).

Get Organization by ID

Create a connection for a given Organization.

Create Connection

List all the connections for a given Organization.

List Connections

Retrieve a connection by its ID (Leen's UUID).

Get Connection by ID

List all the jobs for a given Connection.

List Jobs by Connection ID

Test the connection credentials for a given Connection.

Test Connection Credentials by Connection ID

Delete a connection by its ID and Organization ID (Leen's UUID).

Delete Connection

Update Connection

Create a one-time use connection invite token for an Organization.

Create Connection Invite Token

List all the created connection invite tokens for a given Organization.

List Connection Invite Tokens

OnRamp is Leen's embeddable onboarding component that allows your users to easily create new connections or update existing connections. As an embeddable component, OnRamp is designed to be integrated directly into your application workflow.

Leen Model	SentinelOne¹	CrowdStrike	Microsoft Defender
`vendor_id`	✅	✅	✅
`title`	✅	✅	✅
`description`		✅	✅
`assigned_user`		✅	✅
`severity`	✅	✅	✅
`vendor_severity`	✅	✅	✅
`status`	✅	✅	✅
`vendor_status`	✅	✅	✅
`first_event_time`	✅	✅	✅
`last_event_time`	✅	✅	✅
`resolved_time`		✅	✅
`pid`	✅	✅	✅
`process_created_at`			✅
`process_filename`		✅	✅
`process_command_line`	✅	✅	✅
`process_sha1`	✅		✅
`process_sha256`	✅	✅	✅
`process_md5`	✅	✅
`parent_pid`	✅	✅	✅
`user_name`	✅	✅	✅
`windows_sid`			✅
`active_directory_username`	✅		✅
`active_directory_domain`	✅		✅

`tactic_name`	✅	✅
`tactic_id`		✅
`tactic_source`	✅

`technique_name`	✅	✅
`technique_id`		✅
`technique_link`	✅

Get Started

Integrations

OnRamp

​Supported Fields

Supported Fields