Who this is for: organisation admins.
Find your integrations
Select Integrations in the side menu. Each integration you can use is shown as a tile. If an integration has connections, its tile shows how many are Failed and how many are Active, along with the total number of connections.
Open an integration
Select a tile to open that integration. The Connections tab lists each connection with its Status, Events captured, Last event and Created date. Integrations that sync users also show a Users column.
What the statuses mean
Configuring: the connection has just been added and CybSafe is checking it.
Active: CybSafe can reach the connection.
Failed: CybSafe couldn't reach the connection. Check the credentials first.
Paused: you've paused the connection. No new data comes in until you resume it.
Deactivated, Status unavailable or Status temporarily unavailable: CybSafe isn't currently receiving data from the connection or can't confirm its state.
Archived: the connection is hidden and no longer checked.
Get notified when a status changes
Subscribe to status notifications and CybSafe tells you when a connection's status changes, for example from Active to Failed.
Select Integrations in the side menu, then the Notifications tab.
Under Status notifications, choose how you want to hear. Email is always available. Slack and Microsoft Teams appear once CybSafe is connected to them.
Turn on All integrations, or leave it off and tick the integrations you want under Select the integrations you would like notifications for:.
Select Send test notification to check it reaches you. The button changes to Test sent.
Your choices save as you make them.
Each notification is titled Integration status update. It names the integration, shows the old and new status, and links back to Integrations.
FAQs
Who gets the notifications? Only you. Each admin sets up their own.
How quickly will I hear? CybSafe checks most integrations once a day, so a failure can take up to a day to show. You're notified as soon as the status changes.
Which changes do I hear about? Any change of status, including a connection recovering to Active and a new connection moving from Configuring to Active.
Can I choose a single connection? No. You choose integrations. If you have several connections for one integration, open it to see which one changed.
Why can't I choose Slack or Microsoft Teams? They only appear once your organisation has connected CybSafe to Slack or Microsoft Teams.
What happens to my ticked integrations if I turn on All integrations? They're replaced. If you turn All integrations off again, nothing is selected, so tick the ones you want.
How do I stop notifications? Untick the integrations, or select Unsubscribe from all.
Pause, edit or archive a connection
Use the actions menu at the end of a connection's row. Pause stops new data straight away without removing anything already collected; select Resume to start it again. Edit lets you change the connection's settings. After you save, CybSafe checks the connection in the background, so its status may take a moment to update.
Check and update Microsoft permissions
Microsoft integrations need permissions granted in your Microsoft tenant. If one is missing, some data isn't collected.
Open a Microsoft integration, such as Microsoft Defender, and stay on the Connections tab.
The Permissions column shows how many permissions are granted, for example 5 of 6 granted. Select it to see each permission, whether it's Required or Recommended, and whether it's Granted or Missing.
To grant what's missing, select Update permissions. You'll find it in the permissions window and in the connection's actions menu.
Sign in to Microsoft as a Global Administrator or Privileged Role Administrator and accept the permissions.
You come back to CybSafe, which shows Checking your Microsoft permissions. When everything is granted you'll see Permissions updated.
FAQs
What's the difference between Required and Recommended? A missing required permission stops the data that depends on it. Recommended permissions turn on extra data, such as newer behaviours.
I granted them but they still show as Missing. Microsoft can take a few minutes to apply new permissions. CybSafe keeps checking in the background and the page updates on its own.
Microsoft said I can't grant them. Only a Global Administrator or Privileged Role Administrator in Microsoft Entra can. Application Administrator isn't enough. If consent is declined, CybSafe shows "Microsoft did not grant the permissions."
How up to date is the list? It shows the permissions at CybSafe's last check, which runs every night, and straight after you use Update permissions.