XM Cyber is a breach and attack simulation (BAS) solution that helps organizations improve their cybersecurity posture by simulating attack scenarios to identify weak defenses and control gaps. The Balbix integration with XM Cyber ingests the findings from attack simulations performed by XM Cyber on IT infrastructure assets and applies them to the applicable assets and vulnerabilities.
Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.
Integration Summary
This table provides a summary of the Balbix integration for the XM Cyber connector.
Integration Type | Fetch: An inbound API integration to fetch IT the simulated attack results and the associated IT infrastructure assets. |
Types of Assets Fetched | Host devices (includes servers, virtual machines, desktops, laptops). |
Types of Data Fetched | Asset ID, asset name, asset type, interface information (MAC address, IP address), location, OS information, vulnerability (CVE or misconfiguration), BAS data, exploit status (blocked or not blocked), compromised rate, and associated MITRE ATT&CK information such as tactics and techniques. |
Prerequisites
To configure the Balbix connector, you must first create XM Cyber API credentials with the appropriate permissions. These credentials are required for completing the configuration process.
Here are the steps you need to complete:
Create API credentials.
Obtain an authentication token in JSON Web Token (JWT) format.
Create Credentials
In the navigation pane of the Deploy app, click Credentials.
On the Credentials page, go to the Organization tab and click Create Credentials.
In the Automation Client, enter a label for the client in the Label field. The following characters are not allowed in the Label and Description fields:
# @ " + & >.Optional: Add a description for your client in the Description field.
Click Create.
Copy Client ID and Client Secret and securely save them for later use when setting up the XM Cyber connector in Balbix.
Caution: The client secret is generated only once. If it is lost, you will need to create a new authentication client.
Follow these steps to generate a client ID and secret for the XM Cloud environment.
Request a JWT
To generate the JWT access token (XM Cyber Token), run the following command in a terminal:
curl --request POST \
--url "https://auth.sitecorecloud.io/oauth/token" \
--header "content-type: application/x-www-form-urlencoded" \
--data audience=https://api.sitecorecloud.io \
--data grant_type=client_credentials \
--data client_id=<your-client-id> \
--data client_secret=<your-client-secret>Create and Configure the Connector
After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for XM Cyber.
Step 1: Select the Connector
Start by selecting a connector using the steps outlined below:
Go to Data Sources from the left navigation bar.
In the Connectors table, click + Add Connector.
Click Select a Connector to Configure to expand the window and view the list of available connectors.
Click the + icon on the XM Cyber tile.
Choose API as the Integration Option, then click Next to configure the connector.
Step 2: Configure the Connector
Configure the connector using the steps outlined below: