Documentation Center
AlienVault® USM Anywhere™

Configuring the AlienApp for Box

  Role Availability   Read-Only   Analyst   Manager

Connected through the Box application programming interface (API), the AlienApp for Box uses a predefined scheduler job to collect information from Box every 20 minutes, such as authentication events, user profile updates, user state changes, application and group assignment, and Box platform changes. After USM Anywhere collects and analyzes the first of these events, you can view them in Activity > Events and the Box dashboard.

Important:  

  • You must have access to your Box Enterprise account for configuring the integration with the AlienApp for Box.
  • The USM Anywhere Sensor you want to use for the AlienApp for Box must have outbound connectivity to api.box.com on port 443.

To enable the AlienApp to connect to the Box API

  1. In USM Anywhere, go to Data Sources > Integrations.
  2. Click the AlienApps tab.

    Access the AlienApps page

  3. In the AlienApps page, click the Box tile.

    The Status tab displays showing that the app is disabled.

  4. If you have more than one deployed USM Anywhere Sensor, select the Sensor that you want to use for the enabled AlienApp.

    USM Anywhere AlienApps operate through a deployed Sensor and use APIs to integrate with the connected third-party technology. Choose the Sensor that can access the integration endpoint. The HTTPS connections to the API will originate from this Sensor.

    Select a deployed sensor used to enable the AlienApp

  5. Click Enable.

    The Status tab refreshes and displays information about integrating with the Box API.

  6. Copy the Box App Client ID value to be used in your Box Enterprise account.

  7. Log into the Box Admin Console.
  8. Authorize the AlienApp for Box to access your Box Enterprise account. For assistance, follow the Box documentation, Enabling Custom Built Applications.

    The authorization grants these permission to the AlienApp:

    • Read and write all files and folders stored in Box
    • Manage enterprise properties
    • Admin can make calls on behalf of Users
    • Manage users
    • Manage app users
    • Generate Tokens
  9. For the API Key, enter the Box App Client ID copied above.

    Under Custom Applications, after the authorization succeeds, the USM Anywhere AlienApp for Box appears.

  10. In the Admin Console menu, click Account & Billing.
  11. Locate the Enterprise ID field and copy the value to be used in USM Anywhere.
  12. Return to the AlienApp for Box page in USM Anywhere and select the Settings tab.
  13. Enter the Box Enterprise ID copied above and click Save.

  14. Select the Status tab to verify the connection.

    If the icon appears, there is a problem with the connection. The Message column provides information about the issue. Repeat the steps to fix the configuration or troubleshoot your Box Enterprise account.

  15. In the USM Anywhere main menu, go to Settings > Scheduler and search for the collection job for Box.
  16. Enable the job if it is not already enabled.

    When this job runs for the first time after the connection, it collects Box events during the last 24 hours. On subsequent runs (every 20 minutes), it only collects new events since the last check.