SolarWinds Incident Response

Overview

The SolarWinds Incident Response integration connects your SolarWinds Incident Response (formerly Squadcast) organization to Oneleet and syncs its users, so Oneleet can track who has access to your incident response platform.

What does Oneleet monitor?

• SolarWinds Incident Response users, including their organization role (Account Owner, User, or Stakeholder)

The SolarWinds Incident Response API doesn’t report whether a user has two-factor authentication enabled, so Oneleet can’t check it.

Setup

To set up the SolarWinds Incident Response integration, navigate to Integrations > Add integration > SolarWinds Incident Response and click Continue.

Oneleet requires a user API refresh token. Generate it for a user who can see every member of the organization, such as the Account Owner.

Creating an API refresh token

1. In SolarWinds Incident Response, open Settings and go to API Tokens
2. Click Add New API Token
3. Under Token Type, select User, then choose the user under Select User
4. Click Generate Token
5. On the User Tokens tab, click the eye icon next to the token to reveal it, then copy it

For more information, see the SolarWinds Incident Response API authentication documentation.

Connecting to Oneleet

1. Enter the API Host: api.squadcast.com for the US data center, or api.eu.squadcast.com for the EU data center
2. Paste the API Refresh Token
3. Click Submit

The token doesn’t expire, but stops working if its user is removed from the organization or the token is deleted.