Skip to content

Deep Instinct

Collects threat event data from Deep Instinct's deep learning-based endpoint protection platform, providing visibility into malware prevention, detection events, and device inventory.
Category Endpoint Security
Connector Name signal-client.deep-instinct
Auth Method API Key (Bearer Token)
Polling Interval 10 min (events), 1 hr (devices); built in, not configurable
Multi-Instance Yes
Vendor Docs Deep Instinct API Documentation

Prerequisites

Vendor Requirements

Active Deep Instinct subscription with API access. Admin role required to generate API keys.

  • Active Deep Instinct D-Appliance or D-Cloud subscription
  • Administrator access to the Deep Instinct Management Console
  • Network: Conductor can reach your Deep Instinct management server on port 443

Step 1: Create API Credentials

  1. Log in to the Deep Instinct Management Console at https://<your-instance>.deepinstinctweb.com/
  2. Navigate to Settings → API Keys
  3. Click Generate New API Key
  4. Configure the key:
    • Name: WitFoo Conductor
    • Permissions: Read-only
  5. Copy the generated API Key

Store Credentials Securely

API keys grant access to your Deep Instinct data. Store them securely and do not share them in tickets or email.

Step 2: Configure in Conductor

  1. Open the Conductor UI at https://<conductor-ip>/admin/settings/integrations
  2. From the Add Integration dropdown, select Deep Instinct
  3. Enter a unique name for this instance

  4. Fill in the settings form:

    Field Value Description
    Host <your-instance>.deepinstinctweb.com Management server URL
    API Key <your-api-key> API key from step 1

  5. Toggle Enabled to on

  6. Click Save

Step 3: Validate Data Flow

After saving, verify the integration is working:

  1. Check connection status — The integration tile should show a green status indicator within 1–2 polling cycles

  2. Check Signal Client logs:

    docker logs signal-client-svc --tail=50 | grep "deep-instinct"

    Look for successful poll messages:

    [INFO] deep-instinct: fetched <N> events

  3. Check artifacts in Analytics — Navigate to the WitFoo Analytics Signals → Search page and search for artifacts from this source

First Poll Timing

The connector polls on a built-in schedule that cannot be changed (see Polling Interval above). Expect the first data within one interval of saving.

Troubleshooting

Authentication Failed (401)

  • Verify the API Key is correct and has not been revoked
  • Ensure the key has not expired in the Deep Instinct Console

Forbidden (403)

  • The API key may lack read permissions
  • Generate a new key with appropriate permissions

Rate Limited (429)

  • The polling interval is built in and cannot be changed
  • Conductor automatically implements exponential backoff on 429 responses

No Data Appearing

  • Confirm the integration shows Enabled in the Conductor UI
  • Check Signal Client logs for errors: docker logs signal-client-svc --tail=100
  • Verify network connectivity: curl -I https://<your-instance>.deepinstinctweb.com
  • Confirm events exist in the Deep Instinct console for the polling time window

See also: Integration Catalog · Integration Management · Signal Client · Common Troubleshooting