Admin Guide

Synapse-Cybera Admin Guide

Getting Started

Check with your Admin to enable permissions and find out if you need a personal API key.

Synapse-Cybera requires a CYBERA API key. Keys are delivered out-of-band via an onboarding email from access@cybera.io.

Configuration

Setting the configuration for global use

To set up a global configuration:

cybera.config.add default myapikey

Setting a personal configuration

To set up a configuration scoped to your own user:

cybera.config.add --scope self my_config myapikey

The API key is checked against the CYBERA API when a configuration is added or updated. Pass --no-check-apikey to skip that check.

Viewing a configuration

> cybera.config.show default
Name: default
Scope: global
Owner: n/a
Configs:
  Proxy: true
  SSL Verify: true
  Tag Prefix: rep.cybera
Secrets:
  API Key: myapikey

Listing configurations

> cybera.config.list
 name                      | scope    | owner
===========================|==========|====================================================
 default                   | global   | n/a

Updating a configuration

To change the tag prefix used when recording data from Cybera:

cybera.config.update default --tag-prefix my.cybera

To change the tag prefix on every configuration at once:

cybera.config.migrate --tag-prefix my.cybera

Permissions

Synapse-Cybera defines the following permissions:

• power-ups.cybera.user – General user access.

• power-ups.cybera.admin – Admin access.

To grant a user access to Synapse-Cybera:

> auth.user.addrule visi power-ups.cybera.user
Added rule power-ups.cybera.user to user visi.

To grant a role access to Synapse-Cybera:

> auth.role.addrule ninjas power-ups.cybera.user
Added rule power-ups.cybera.user to role ninjas.

Access to an individual configuration is controlled separately, so a user with power-ups.cybera.user still needs read permission on the configuration they intend to use. To grant a user read access to a configuration:

> cybera.config.update default --perm user visi read
Updated Synapse-Cybera config "default"

To grant a role read access to a configuration:

> cybera.config.update default --perm role ninjas read
Updated Synapse-Cybera config "default"

Deleting a configuration

> cybera.config.del default
Synapse-Cybera config "default" deleted

Workflows

Synapse-Cybera provides the following workflows in Optic:

Title: Configuration

Node Actions

Synapse-Cybera provides the following node actions in Optic:

Name : intel.evidence
Desc : Ingest the Cybera evidence package for a reported mule account
Forms: risk:attack