SIEM integration
Automate LevelBlue USM Anywhere SIEM with plain language
Read USM Anywhere alarms, events and assets, and forward VernacSecure SuperBot™ observations for correlation with the built-in threat intelligence.
What you can do
LevelBlue (AT&T Cybersecurity) USM Anywhere — REST API v2
- List alarms and their severity
- Search recent events
- Read the asset inventory
- Forward a VernacSecure SuperBot™ event
Connection: bearer authentication against https://api.usm.alienvault.cloud. Credentials are encrypted at rest, or prompted per action if you prefer never to store them.
Example
Ask in plain English
Prompt: “Show the last 24 hours of high severity alerts in LevelBlue USM Anywhere”
Result: VernacSecure SuperBot™ runs the search, normalises the results and offers follow-up actions on other integrations.
Read actions
- Fetch alarms — Lists alarms.
- Fetch events — Lists recent events.
- Fetch assets — Lists assets in the inventory.
Write actions
- Forward event — Forwards a VernacSecure SuperBot™ event.
Related siem automation pages
Armor Point · Datadog Cloud SIEM · Devo Platform · Elastic Security · Exabeam Security Operations · Fortinet FortiSIEM