Cloud Threat Analytics: SaaS Alerts Onboarding

Creating New Organizations:

• Head over to the “Organizations” tab
• Click the green “New Organization” button on the upper right side of the page.
• Add your Company name followed by space-hyphen-space and then the Company name of the client you are on-boarding (Example: Bob Bagels - The Fireworks)
• Next Select your group (there should be only one so you can also check the box for “Select all groups”)
• Next add your customer's domain/URL and then select "Standard" for the "License Type"
• Next is power filters.
  • Add the Country where this customer/client is primarily located (typically the United States).
    • This will let our SOC know where legitimate activity should be occurring
    • Also NOTE: Individual user power filtering can be added after onboarding
• You can skip the IP power filters (see image) and click “Create Organization”
  
  
• Now you are at the on-boarding page where you can select “New Application” and on-board any of the listed SaaS Alert’s applications

How To On-board SaaS Alerts' Applications

• Login to SaaS Alerts! and select the “Organizations” Tab
• Next click the pencil icon next to the Organization you are wanting to add an application to.
• Click “New Application”
• Lastly, select the application you would like to on-board and use the steps below to complete.
  

 

Microsoft 365 Onboarding

• Click on the Microsoft “connect” button to authenticate.
  
• Click on or Add the desired account that has global admin access for this customer
  
• Review and accept permissions
  • Look in the top right of the URL address bar for the blocked pop-up notification
    • Select to allow popups from SaaS Alerts
      
• Validate the Microsoft button changes from a grey background to a green background
  1. 1. • If not…Click the back button and repeat steps 4&5 above

 

After Completing the On-boarding please wait at least 30 minutes for SaaS' query with the App to take effect and fully connect. Below are Indicators the On-Boarding may have failed and how to view the errors:

• The Organization’s Total Users and/or Billable Users do not populate a value other than “0”.
  • The Status may additionally say Broken Connection Indicating the on-boarding was has an error
• The application “Microsoft” is in a red font indicating there is some sort of error that needs to be fixed.
  1. • To view the specific error(s), click on the pencil (edit) button to the bottom left of the Organization
• Next Click the application that is red. (Please note there may be more than one error listed)

 

 

 

Microsoft Organization Errors Explained:

• If the error says:
  “Microsoft is reporting the following error: Neither tenant is B2C or tenant doesn't have premium license
  The Microsoft Tenant Organization is limited to the functionality provided by a "Free" Azure AD license. Managed Service Providers are encouraged to consider upgrading the Tenant to use Azure AD Premium Licensing (P1 or higher)”

You can disregard as it is more of an informational error indicating it is on a Free Azure AD License.

• If the error says:
  ”Microsoft is reporting the following error: Exception: Microsoft.Office.Compliance.Audit.DataServiceException: Tenant does not exist.

This means that auditing is not turned on for this tenant. Turn on auditing or search our helpdesk for "tenant does not exist". Once completed, please try connecting again.”

• You will need to turn on the audit log. To do this, follow the instructions provided in this link: MS Audit Off Fix
• 24 hours after completion, click the “Check status” button. If successful you will get a green notification in the top right of the page. If the audit log has not been enabled it will have a red error pop up in the top right of the screen.

For any other errors you may need to on-board the client again. To do this:

• Click on the “Reconnect” button.
  

Google Workspace Onboarding

• Setup instructions for Google Workspace can be found here: Setup instructions for Google Workspace

 IT Glue

• Setup instructions for IT Glue can be found here: Setup instructions for IT Glue

HUDU

• Setup instructions for HUDU can be found here: Setup instructions for HUDU

Ninja One RMM

• Setup instructions for Ninja One can be found here: Setup Instructions for Ninja One

Syncro RMM

• Setup instructions for Syncro can be found here: Setup Instructions for Syncro

Datto RMM

• Setup instructions for Datto can be found here: Setup Instructions for Datto

N-Able N-Central RMM

• Setup instructions for N-Able N-Central can be found here: Setup Instructions for N-Able N-Central RMM

Kaseya VSA

• Setup instructions for Kaseya can be found here: Setup Instructions for Kaseya VSA

ConnectWise Automate

• Setup instructions for ConnectWise Automate can be found here: Setup Instructions for ConnectWise Automate

Slack

• Setup instructions for Slack can be found here: Setup Instructions for Slack

Salesforce

• Setup instructions for Salesforce can be found here: Setup Instructions for Salesforce

Dropbox

• Setup instructions for Dropbox can be found here: Setup Instructions for Dropbox

Okta

• Setup instructions for Okta can be found here: Setup instructions for Okta

• Setup instructions for Duo can be found here: Setup instructions for Duo

AWS CloudTrail

• Setup instructions for AWS CloudTrail can be found here: Setup instructions for AWS CloudTrail

Egnyte

• Setup instructions for Egnyte can be found here: Setup instructions for Egnyte

Windows Defender

• Setup instruction for Windows Defender can be found here: Setup instructions for Windows Defender

Datto EDR

• Setup instruction for Datto EDR can be found here: Setup instructions for Datto EDR

SentinelOne

• Setup instruction for SentinelOne can be found here: Setup instructions for SentinelOne