> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Upwind

> Configure the Upwind Cloud Security integration with RAD Security to ingest cloud threats and runtime activity events.

# Upwind Cloud Security Integration Setup

This guide walks you through integrating Upwind with RAD Security to ingest cloud threats and cloud runtime activity events for unified threat detection and investigation.

Upwind provides cloud-native application protection (CNAPP) across your cloud environment. RAD Security connects to the Upwind API using OAuth 2.0 client credentials and pulls cloud threats and runtime activity events on a scheduled basis to correlate them with your runtime and Kubernetes security data.

<Info>
  **Read-only integration:** RAD Security only reads data from Upwind. It never writes to, modifies, or deletes resources in your Upwind environment.
</Info>

## Prerequisites

Before you begin, ensure you have:

<Check>
  * An Upwind account with API access
  * Permission to create API credentials (client ID and secret) in Upwind
  * Your Upwind Organization ID
  * The Upwind region for your tenant (`US`, `EU`, or `ME`)
  * Access to a RAD Security workspace with integration permissions
</Check>

## Understanding Integration Components

<AccordionGroup>
  <Accordion title="OAuth 2.0 Client Credentials" icon="key">
    RAD Security authenticates to the Upwind API using the OAuth 2.0 client-credentials grant. You provide a **Client ID** and **Client Secret** generated in Upwind, and RAD exchanges them for short-lived access tokens automatically.
  </Accordion>

  <Accordion title="Organization ID" icon="building">
    The **Organization ID** identifies your Upwind organization and is used in the Upwind API path. You can find it in your Upwind organization/account settings.
  </Accordion>

  <Accordion title="Region" icon="globe">
    Upwind operates regional deployments. The **Region** (`US`, `EU`, or `ME`) selects both the OAuth audience and the API base URL. It must match the region of your Upwind tenant.
  </Accordion>

  <Accordion title="Scheduled Polling" icon="clock">
    RAD Security ingests Upwind data via scheduled polling. Webhooks are **not** used for this integration — data arrives on RAD's polling cadence rather than being pushed by Upwind.
  </Accordion>
</AccordionGroup>

***

## Step 1: Create API Credentials in Upwind

<Steps>
  <Step title="Sign in to the Upwind Console">
    Log in to the Upwind console with an account that has permission to manage API access.
  </Step>

  <Step title="Create an API Client">
    Navigate to **Settings → API access** and create a new API client or service account. Generate the credentials to obtain your **Client ID** and **Client Secret**.

    <Warning>
      Copy the **Client Secret** immediately. Many platforms show the secret only once at creation time. Store it securely in a password manager or secrets vault.
    </Warning>
  </Step>

  <Step title="Locate Your Organization ID">
    Find your **Organization ID** in your Upwind organization or account settings.
  </Step>

  <Step title="Determine Your Region">
    Identify the **Region** of your Upwind tenant — `US`, `EU`, or `ME`.
  </Step>
</Steps>

<Note>
  Exact console navigation and labels may vary across Upwind versions. See the [Upwind documentation](https://docs.upwind.io) for the current steps to create API credentials.
</Note>

***

## Configure in RAD Security

Navigate to your RAD Security workspace and configure the Upwind integration with the following parameters:

### Required Parameters

| Parameter           | Description                                                                       |
| ------------------- | --------------------------------------------------------------------------------- |
| **Client ID**       | Upwind OAuth 2.0 Client ID                                                        |
| **Client Secret**   | Upwind OAuth 2.0 Client Secret                                                    |
| **Organization ID** | Upwind organization identifier used in the Upwind API path                        |
| **Region**          | Upwind region — `US`, `EU`, or `ME` — selects the OAuth audience and API base URL |

***

## Verify Integration

<Steps>
  <Step title="Check Connection Status">
    1. Navigate to **Data Sources > Integrations > Cloud Security** in RAD Security
    2. Locate your Upwind integration
    3. Verify the connection status shows as **Connected**
  </Step>
</Steps>

<Check>
  Your Upwind integration is now configured! RAD Security will ingest cloud threats and runtime activity events from Upwind on a scheduled basis.
</Check>

## What Data is Synced

<AccordionGroup>
  <Accordion title="Cloud Threats" icon="radar">
    Cloud threat detections, mapped to OCSF Detection Findings, correlated with runtime and Kubernetes signals.
  </Accordion>

  <Accordion title="Runtime Activity Events" icon="wave-pulse">
    Cloud runtime activity — process, network, DNS, and cloud events — mapped to OCSF Activity events and stored alongside RAD's other activity feeds.
  </Accordion>
</AccordionGroup>

## Use Cases

<CardGroup cols={2}>
  <Card title="Threat Investigation" icon="magnifying-glass">
    Investigate Upwind cloud threats with context from RAD runtime and Kubernetes detections.
  </Card>

  <Card title="Runtime Activity Monitoring" icon="wave-pulse">
    Track cloud runtime activity — process, network, and DNS events — to understand workload behavior.
  </Card>

  <Card title="Correlated Detection" icon="diagram-project">
    Correlate Upwind threats and activity with RAD runtime signals to cut through the noise.
  </Card>

  <Card title="RADBot Prioritization" icon="robot">
    Leverage RADBot to prioritize Upwind threats by real-world impact.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="triangle-exclamation">
    **Possible causes:**

    * Incorrect Client ID or Client Secret
    * Client credentials were revoked or disabled in Upwind

    **Solution:**

    * Verify the Client ID and Client Secret are copied correctly (no extra spaces)
    * Confirm the API client is still active in **Settings → API access**
    * Regenerate the credentials in Upwind and update them in RAD Security if needed
  </Accordion>

  <Accordion title="Wrong Region" icon="globe">
    **Possible causes:**

    * The selected Region does not match your Upwind tenant
    * Audience mismatch causing token exchange to fail

    **Solution:**

    * Confirm your tenant's region (`US`, `EU`, or `ME`)
    * Update the **Region** parameter to match and reconnect
  </Accordion>

  <Accordion title="Empty Results" icon="inbox">
    **Possible causes:**

    * Incorrect Organization ID
    * The organization has no threats or runtime activity events in scope

    **Solution:**

    * Verify the **Organization ID** matches your Upwind organization
    * Confirm data exists in the Upwind console for the configured organization
  </Accordion>
</AccordionGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use a Service Account" icon="user-gear">
    Create dedicated API credentials for the RAD integration rather than tying them to a personal account.
  </Card>

  <Card title="Least Privilege" icon="shield-halved">
    Grant only the read permissions required for threats and runtime activity events.
  </Card>

  <Card title="Rotate Credentials" icon="rotate">
    Rotate the Client Secret periodically according to your security policy.
  </Card>

  <Card title="Secure Secret Storage" icon="vault">
    Store the Client Secret in a secrets vault. Never commit it to version control.
  </Card>
</CardGroup>

## Additional Resources

<CardGroup cols={2}>
  <Card title="Upwind Documentation" icon="book" href="https://docs.upwind.io">
    Official Upwind documentation, including API access and credentials
  </Card>

  <Card title="Cloud Security Overview" icon="cloud-bolt" href="/rad-security/integrations/cloud-security/overview">
    Learn about RAD's cloud security integrations
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Cloud Security Integrations" icon="cloud-bolt" href="/rad-security/integrations/cloud-security/overview">
    Explore other cloud security integration options
  </Card>

  <Card title="Data Sources" icon="database" href="/rad-security/integrations/data-sources">
    Connect additional security data sources
  </Card>

  <Card title="RADBot" icon="robot" href="/rad-security/getting-started/radbot">
    Learn how RADBot helps prioritize findings
  </Card>
</CardGroup>