MSSP Unified Security Dashboard

Threat Radar

SentinelOne · Mimecast · Ninja RMM · Auvik · Backup

SEVERITY ↕	SOURCE API	CLIENT ↕	ASSET	EVENT	TIME ↕	STATUS

Security · SentinelOne

YOUR-TENANT.sentinelone.net/web/api/v2.1

Active Threats

↑1 in last hour

GET /threats?resolved=false
→ pagination.totalItems

Quarantined Hosts

WS-FINANCE-01

GET /agents?networkStatus=disconnected
→ data[].networkStatus

Lateral Movement

None detected

GET /threats?classification=Lateral+Movement
→ pagination.totalItems

Exploit Attempts

CVE-2024-1234

GET /threats?classification=Exploit
→ pagination.totalItems

Infrastructure · RMM

api.ninjarmm.com/v2 · api.n-able.com/v1

Offline Devices

↑3 vs 4h ago

GET /v2/devices?df=status+eq+OFFLINE
→ count of results array

Agent Errors

Check-in failed

GET /v2/devices?df=agentStatus+eq+ERROR
→ data[].agentStatus

Reboot Pending

Post-patch reboot

GET /v2/devices?df=rebootRequired+eq+true
→ data[].rebootRequired

Patch Failures

KB5034441 + 6 others

GET /v2/jobs?status=FAILED&type=PATCH_MANAGEMENT
→ results[].jobStatus

Network · Auvik

auvikapi.us1.my.auvik.com/v1 · Auth: Basic base64(user:apiKey)

Devices Down

Branch-SW-01 · AP-3F

GET /v1/inventory/device/info
?filter[deviceStatus]=offline → data[].attributes

Network Alerts

3 high · 2 medium

GET /v1/alert/history/info
?filter[resolved]=false → data[].attributes.severity

Interface Errors

Core-SW-01 Gi0/1

GET /v1/statistics/interface/detail
?filter[errorRate]=gt:0 → data[].attributes.inErrorRate

High CPU Switches

All within threshold

GET /v1/statistics/device/detail
?filter[cpuUsage]=gte:80 → cpuUtilization

Backup · BCDR

api.datto.com/v1/bcdr · axcient.com/api/v2 · api.acronis.com/api/2

Failed Backups

VM-SQL01 · FS-01 · DC-02

Datto: GET /v1/bcdr/device/{id}/alert?alertType=backupFailure
Acronis: GET /api/2/activities?status=error

Unprotected Devices

No active plan

Acronis: GET /api/2/resources
?hasActiveProtectionPlan=false → items[].id

Backup Age > 24h

SLA risk · 3 clients

Datto: GET /v1/bcdr/device → compare
items[].lastOffsite timestamp to now−86400s

Storage Capacity Warning

SIRIS-04 at 87%

Datto: GET /v1/bcdr/device/{id}/local
→ storageUsed / storageTotalMB × 100

Email Security

Mimecast · Proofpoint

api.mimecast.com/api · tap-api-us.proofpoint.com/v2/siem

Phishing Attempts

↑3 vs yesterday · 2 users clicked

Mimecast: POST /api/ttp/url/get-logs
Proofpoint: GET /v2/siem/clicks/permitted
field: clicksPermitted[].url + threatStatus

Malware Attachments Blocked

All quarantined · 0 delivered

Mimecast: POST /api/ttp/attachment/get-logs
Proofpoint: GET /v2/siem/threats?threatType=attachment
field: messagesBlocked[].threatsInfoMap[].threatType

Impersonation Attempts

CEO spoofing · [email protected]

Mimecast: POST /api/ttp/impersonation/get-logs
body: {identityAlerts:true}
field: data[].action + taggedExternal

Suspicious Domains Blocked

7 new today · DNS block applied

Mimecast: POST /api/dns/get-managed-sender
Proofpoint: GET /v2/siem/threats?threatType=url
field: unique domain count from url field