Upwind

The Britive and Upwind integration brings Upwind's findings about risky cloud roles into Britive. Britive then shows whether each flagged role is governed by a Britive profile (resolved) or not (unresolved). You can use this to find roles with standing privileges and move them under Just-In-Time (JIT) access.

Adding an Upwind Integration

Note:

The administrator must have securityadmin.security.manage permission to add or manage Upwind integrations.

1. Log in to Britive with administrator privileges.

2. Click on System admin -> CSPM Integration.

3. Click New Integration or click Manage to update the existing integration.

4. Click + to create a new Upwind integration.

   1. Enter the name and description in the Add Upwind Integration window.

   2. Click Add.

   3. Copy the generated token and ingest URL. You need these values to configure Upwind. The token is shown only once.

   4. Click Ok.

5. Settings tab:

   1. Click Edit to update the name and description.

   2. Rotate Token: Click Rotate Token if you want to create a new token. It invalidates the existing token, and active CSPM integrations using this token stop working. The new token must be reconfigured on the Upwind side.

   3. Sync Now: Pulls the existing findings from Upwind’s API using the saved API credentials.

   4. Add Credentials (Optional): A separate API client can be configured to sync findings using Upwind’s API.

      1. Enter the following details of Upwind’s API client: client ID, client secret, organization ID, and region.

      2. You need to create an API client in Upwind (Settings → Credentials) with read access to configuration findings.

   5. Edit Filters (Optional): Click to add cloud providers to filter findings. These filters apply to both Webhook findings and syncs.

      1. Click Add Cloud Provider to add a particular provider so that only findings from that cloud and accounts are kept.

      2. Enter the account IDs to specifically get findings for those accounts. If you leave this field empty, all findings of all accounts of this provider are synced. Filters apply to findings that arrive from then on; findings already stored are not deleted.

6. Findings tab: After integration is complete on both the Britive and Upwind sides, the Findings tab is populated. Findings are pulled automatically through Webhook or on demand using the Sync Now option. This tab lists security risks, vulnerabilities, and misconfigurations uncovered by the Upwind.

   • Source Role

   • Highest Severity

   • Application

   • Profiles

   • Britive role

   • Environment

   • Status

   • Source

   • Findings

   • Source environment

   • Application type

Configuring on Upwind

1. Get the Britive-generated token and ingest URL.

2. Add a custom webhook pointing to the connection URL.

3. In Upwind's webhook settings, choose API Key as the authentication type, enter Authorization as the header name, and paste the token as the value.

4. Test the webhook connection to ensure the integration is enabled.