Upwind
Configure the Upwind Cloud Security integration with RAD Security to ingest cloud threats and runtime activity events.
This guide walks you through integrating Upwind with RAD Security to ingest cloud threats and cloud runtime activity events for unified threat detection and investigation.
Upwind provides cloud-native application protection (CNAPP) across your cloud environment. RAD Security connects to the Upwind API using OAuth 2.0 client credentials and pulls cloud threats and runtime activity events on a scheduled basis to correlate them with your runtime and Kubernetes security data.
Read-only integration: RAD Security only reads data from Upwind. It never writes to, modifies, or deletes resources in your Upwind environment.
Prerequisites
Before you begin, ensure you have:
- An Upwind account with API access
- Permission to create API credentials (client ID and secret) in Upwind
- Your Upwind Organization ID
- The Upwind region for your tenant (
US,EU, orME) - Access to a RAD Security workspace with integration permissions
Understanding Integration Components
Step 1: Create API Credentials in Upwind
Sign in to the Upwind Console
Log in to the Upwind console with an account that has permission to manage API access.
Create an API Client
Navigate to Settings → API access and create a new API client or service account. Generate the credentials to obtain your Client ID and Client Secret.
Copy the Client Secret immediately. Many platforms show the secret only once at creation time. Store it securely in a password manager or secrets vault.
Locate Your Organization ID
Find your Organization ID in your Upwind organization or account settings.
Determine Your Region
Identify the Region of your Upwind tenant — US, EU, or ME.
Exact console navigation and labels may vary across Upwind versions. See the Upwind documentation for the current steps to create API credentials.
Configure in RAD Security
Navigate to your RAD Security workspace and configure the Upwind integration with the following parameters:
Required Parameters
| Parameter | Description |
|---|---|
| Client ID | Upwind OAuth 2.0 Client ID |
| Client Secret | Upwind OAuth 2.0 Client Secret |
| Organization ID | Upwind organization identifier used in the Upwind API path |
| Region | Upwind region — US, EU, or ME — selects the OAuth audience and API base URL |
Verify Integration
Check Connection Status
- Navigate to Data Sources > Integrations > Cloud Security in RAD Security
- Locate your Upwind integration
- Verify the connection status shows as Connected
Your Upwind integration is now configured! RAD Security will ingest cloud threats and runtime activity events from Upwind on a scheduled basis.
What Data is Synced
Use Cases
Threat Investigation Investigate Upwind cloud threats with context from RAD runtime and Kubernetes detections.
Runtime Activity Monitoring Track cloud runtime activity — process, network, and DNS events — to understand workload behavior.
Correlated Detection Correlate Upwind threats and activity with RAD runtime signals to cut through the noise.
RADBot Prioritization Leverage RADBot to prioritize Upwind threats by real-world impact.
Troubleshooting
Security Best Practices
Use a Service Account Create dedicated API credentials for the RAD integration rather than tying them to a personal account.
Least Privilege Grant only the read permissions required for threats and runtime activity events.
Rotate Credentials Rotate the Client Secret periodically according to your security policy.
Secure Secret Storage Store the Client Secret in a secrets vault. Never commit it to version control.
Additional Resources
Upwind Documentation
Official Upwind documentation, including API access and credentials
Cloud Security Overview
Learn about RAD's cloud security integrations