User Guide

Synapse-Doppel User Guide

Synapse-Doppel adds new Storm commands to allow you to query the Doppel API using your existing API key.

Getting Started

Check with your Admin to enable permissions and find out if you need a personal API key.

Examples

Setting your personal API key

To set-up a personal use API key:

> doppel.config.add myconfig myapikey myuserkey --scope self
Synapse-Doppel config "myconfig" added

Retrieve an alert

> doppel.alert.get --id VEX-10 --yield
risk:alert=1e639ee599c4e64e2224ef805ba5dbf1
        .created = 2026/02/25 20:43:39.638
        :_doppel:alert:queue = needs_confirmation
        :_doppel:alert:status = active
        :ext:id = VEX-10
        :service:account = bcaf9b0dbf5a5f1120eac19a79a85b4a
        :service:platform = e941f7dc54a7c95c7ab9fdcf9328f0fa
        :severity = medium
        :type = doppel.domains
        :url = https://app.doppel.com/alerts/VEX-10

Use of meta:source nodes

Synapse-Doppel uses a meta:source node and -(seen)> light weight edges to track nodes observed from the Doppel API.

> meta:source=415e94b0e51393e268d53fbeb7089eec
meta:source=415e94b0e51393e268d53fbeb7089eec
        .created = 2026/02/25 20:43:39.618
        :name = doppel api
        :type = synapse.doppel

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Doppel. The following example shows how to filter the results of a query to include only results observed by Synapse-Doppel:

> #cool.tag.lift +{ <(seen)- meta:source=415e94b0e51393e268d53fbeb7089eec }

Model Extensions

The following extended props are created by the Synapse-Doppel Power-Up:

risk:alert:_doppel:alert:status
    str - Status of the Doppel alert.

risk:alert:_doppel:alert:queue
    str - Status of which Doppel queue the alert is in.