Cyware Collaborate (CSAP)
Connect Cyware Collaborate (formerly CSAP) to RAD Security and hunt with the indicators, threat actors, vulnerabilities and ATT&CK techniques in the alerts shared with you.
RAD Security connects directly to the Cyware Collaborate Open API (formerly the Cyware Situational Awareness Platform, CSAP) and imports the alerts your credentials can see into two data types: the alerts themselves, and every indicator of compromise they name.
In Collaborate, the threat intelligence lives inside alerts: each advisory carries its indicators (IPs, domains, URLs, file hashes), threat actors, vulnerability details, affected vendors and products, and MITRE ATT&CK techniques. RAD reads each alert's detail and stores all of it, so you can match indicators against what RAD sees in your runtime and cloud environment, and follow a match back to the advisory that named it.
Read-only integration. RAD only lists and reads alerts. It never creates, updates or expires alerts, and never submits intel to Collaborate.
Early access. This integration is enabled on request. Ask your RAD Security contact to turn it on for your workspace.
Prerequisites
- Access to a Cyware Collaborate (CSAP) tenant, as an analyst or as a member
- Open API credentials (access ID and secret key) — generated by an analyst in the Collaborate Analyst Portal
- Your tenant URL,
https://<tenant>.cyware.com - A RAD Security workspace with integration permissions
What RAD can see is what your credentials can see. A member's credentials only return the alerts that were shared with that member. An analyst's credentials return the alerts their role's categories allow.
What RAD stores
| Object | RAD data type | One row per | Refreshed |
|---|---|---|---|
| Alerts | cyware_alerts | alert (advisory) | hourly |
| Indicators | cyware_alert_indicators | indicator per alert | hourly |
- Alerts: title, content, TLP, category, status, published and modified times, the rating fields (severity, confidence, credibility, risk, urgency, priority, kill-chain phase, exploit likelihood, exploited in the wild, announcement type), information sources, threat actors, threat methods, vulnerability types and sources, vendors and products, targeted sectors, ATT&CK tactics and techniques, tags, reference URLs, parent and child alerts, and the indicator types and count
- Indicators: type (as Collaborate names it:
ip,domain,url,md5,sha256, ...), value, whether it is allow-listed (is_allowed = 1) or malicious, and the alert's title, TLP, severity, category and threat actors copied onto the row
cyware_alert_indicators is ordered by type and value, so "has any Collaborate alert named this IP, domain or hash?" is a fast lookup. short_id leads from an indicator back to its alert in cyware_alerts.
Step 1: Get Open API credentials
Ask an analyst to generate credentials
Open API credentials are generated in the Collaborate Analyst Portal under Administration > Open API. If you are a member, ask the analysts who run your Collaborate tenant to generate credentials for you.
Use a role that can read alerts
The credentials only need to read alerts. RAD never creates or changes them.
Copy the access ID and secret key
Keep the secret key safe; it signs every request.
Step 2: Configure in RAD Security
Open Data Sources > Integrations > Threat Feed, add Cyware Collaborate (CSAP) and fill in the fields.
| Field | Value |
|---|---|
| Tenant URL | Your Collaborate URL, for example https://acme.cyware.com |
| Access ID | The Open API access ID |
| Secret key | The Open API secret key |
Only https://<tenant>.cyware.com URLs are accepted. The tenant URL is typed in, so RAD refuses any other host, plain http, ports and extra paths, and checks the URL again before every sync. If your Collaborate tenant is on a custom domain, contact RAD Security support.
The secret key never leaves RAD: every request carries a signature computed from the access ID, the secret key and a short expiry, as the Collaborate Open API requires.
What verification does
Saving the integration checks connectivity and lists one page of alerts from the last day, which proves the credentials can read what the sync reads.
Once the status shows Connected, the first sync starts reading a year of history. It arrives in 30-day steps over about four hours; after that each hourly sync reads only newly published alerts.
Reading the data
An alert is read when it is published
RAD reads each alert's detail once, when it is published. When Collaborate publishes an update to an alert, it appears as a new alert linked to the original through parent_alert_ids and child_alert_ids.
Windowed on publication
Both data types are windowed on published_time, when the advisory was published. The default view shows the last 90 days; widen the window to hunt across the whole history.
Rating fields are labels
Collaborate's rating fields (severity, confidence and so on) are option objects; RAD stores the option's label, for example High. The full alert is kept in the raw column.
Sync cadence and API budget
| What | Cadence |
|---|---|
| New alerts | hourly, 5 minutes behind real time |
| First sync | one year of history, 30 days per step, four steps per hour |
RAD makes one list call per page of alerts and one detail call per alert, paced one call a second. If Collaborate rate-limits the credentials, RAD backs off and resumes later without losing its place.