FireSight OT OT remote access

API and integrations

From 0.4.0 (in beta) the Cloud Hub connects to SIEMs, OT security platforms (Dragos, Claroty, Nozomi Networks, Armis, Tenable, Forescout), ticketing and your own scripts in three ways:

All three are set up by an administrator in the console under API & integrations.

OT security platforms (one click)

The top of the page has a tile for Dragos, Claroty, Nozomi Networks, Armis, Tenable and Forescout. Connect sets up, in one step:

• Our events → the platform: a syslog receiver (CEF, TLS by default) for remote access, Cloud Connectors, machines, sign-ins and alerts. A test event is sent first; nothing is saved if it doesn't arrive.
• The platform → the Hub: a read-only API token (1 year), optionally limited to the platform's address, and optionally allowed to end live sessions when the platform detects a threat (off by default).

Both can be limited to some companies. Disconnect removes the receivers and revokes the tokens at once. Where to add a syslog source or API integration on the platform's side depends on its version; the platform's documentation has the exact menu.

REST API

1. API & integrations → New token. Name it after what will use it, tick what it may do, and optionally limit it to some companies and source addresses. Copy the token: it is shown once.
2. Send it as a bearer token:

   curl -H "Authorization: Bearer fsotapi_…" https://hub.example.com/api/v1/status
   

Scopes:

• A token for all companies acts as an administrator. A token limited to companies acts as an operator of those companies and sees nothing else. The audit log (GET /api/v1/audit) needs an all-companies token.
• Every change made with a token is in the audit log as api:<token name>.
• 20 requests a second per token (bursts to 40); more get 429.
• The full description is at https://<hub>/api/v1/openapi.json (OpenAPI 3): import it into Postman, Swagger UI or your platform's integration builder. The console shows the same list.
• Revoking a token stops it at once.

Webhooks

API & integrations → New webhook: a URL, the event categories, and optionally companies. The Hub POSTs each event as JSON:

{
  "id": "ev_4f1c…", "time": "2026-10-28T13:20:26Z", "type": "access_open", "category": "access",
  "actor": "jo.smith", "vendor": true, "org": "Acme Robotics", "source_ip": "203.0.113.9",
  "target": "resource:res_…", "ok": true, "company": "cus_…", "company_name": "Plant 2",
  "connector": "con_…", "resource": "res_…", "machine": "192.168.1.20:502", "detail": {"name": "Line 1 PLC"}
}

Event categories: access, connectors, machines (machine_down, machine_up), signin, changes, alerts.

Headers: X-FSOT-Event (the type), X-FSOT-Delivery (the event ID, for de-duplication), X-FSOT-Timestamp and X-FSOT-Signature. Check the signature with the signing secret shown when the webhook was made:

import hmac, hashlib, time
def valid(secret, headers, body: bytes):
    ts = headers["X-FSOT-Timestamp"]
    if abs(time.time() - int(ts)) > 300:
        return False
    want = "sha256=" + hmac.new(secret.encode(), ts.encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(want, headers["X-FSOT-Signature"])

A call that fails (no answer or not 2xx within 10 s) is retried after 2 s, 10 s and a minute; the console shows the last success and the last failure. Test sends a test event straight away.

Syslog export

API & integrations → Syslog export → New receiver: the receiver as host:port, the transport and the format. There can be several receivers, each with its own events and companies.

• Transport: TLS (recommended, usually port 6514), TCP or UDP (514). With TLS the receiver's certificate is checked unless you tick the option for a self-signed one.
• Format: CEF (Splunk, ArcSight, Microsoft Sentinel, Dragos, Claroty, Nozomi, Tenable, Forescout), LEEF 2.0 (IBM QRadar) or JSON, each in an RFC 5424 syslog line, facility log audit. Refused access and sign-ins, machines down and Cloud Connectors offline are sent as warnings; everything else as informational.
• CEF fields: rt time, cat category, suser user, src their address, dst/dpt the machine, cs1 resource, cs2 company, cs3 Cloud Connector, cs4 organisation (vendor), cs5 duration, in/out bytes, outcome, msg. Vendor Labhat Group, product FireSight OT.

If the receiver can't be reached the Hub retries every 30 seconds; the console shows the problem and how many events have been sent. Events that arrive while it is down are not queued on disk: the audit log in the console (and audit.jsonl on the Hub) stays the complete record.

Network

The Hub makes these calls itself, outbound: allow it to reach the webhook URLs and the syslog receiver through your firewall. Nothing needs opening inbound beyond the Hub's usual HTTPS port for the REST API.