Connect Qevlar to Sekoia to investigate detections. This page lists the API permissions Qevlar requires and how to grant them.
Overview
Qevlar authenticates to Sekoia with an API key sent as a bearer token — no user sign-in per request. Access is governed by the role assigned to the API key. The connector is read-only.
| API | Purpose | Auth |
|---|---|---|
| Sekoia API | Validate the key and read SIC alerts | API key (bearer) |
The API base is https://api.sekoia.io.
Connection details
Enter these values when configuring the connector in Qevlar:
| Field | Where to find it | Required |
|---|---|---|
| Base URL | Sekoia API base, e.g. https://api.sekoia.io
|
Yes |
| API Key | Sekoia.io → API keys | Yes |
Required permissions
Create an API key whose role grants two permissions: read access to Security Intelligence Center (SIC) alerts (to read the alert Qevlar investigates), and the ability to run event searches (so Qevlar can post Sekoia search queries during the investigation). No write permissions are required.
Setup
- Create an API key. In Sekoia.io, generate an API key.
- Assign a role. Ensure the key's role includes read access to SIC alerts and the ability to run event searches.
- Record the key. Copy it immediately — it is shown only once.
- Configure the connector. In Qevlar, add the Sekoia connector and enter the connection details above.
Verify the connection
After saving, Qevlar runs a health check against the auth-validation endpoint. If it fails, check, in order:
- The API key is valid and has not been revoked.
- The key's role grants read access to SIC alerts and the ability to run event searches.
- The Base URL is correct.
API reference
| Operation | HTTP | Endpoint |
|---|---|---|
| Validate key (health check) | GET | api.sekoia.io/v1/auth/validate |
| Read alert by UUID | GET | api.sekoia.io/v1/sic/alerts/{alertUuid} |
| List alerts | GET | api.sekoia.io/v1/sic/alerts |
Auth header: Authorization: Bearer <apiKey>.