# Securonix

> Securonix builds Unified Defense SIEM — security information and event management combined with
> user and entity behavior analytics (UEBA), security orchestration automation and response (SOAR),
> and, since the June 2025 acquisition of ThreatQuotient, the ThreatQ threat intelligence platform.
> The platform ingests activity data through several hundred connectors, applies MITRE ATT&CK-aligned
> detection policies and behavior analytics, and drives incident workflows for security operations
> teams. Deployed cloud, multi-tenant (MSSP) and on-prem.

Generated by API Evangelist from Securonix's published documentation and specifications.
Not published by Securonix. Last generated 2026-08-26.

## How the API surface is shaped

Securonix does not run a developer portal. The machine-readable contracts live on SwaggerHub under
the `securonix-b7a` organization and are linked from the Developer Guide inside the documentation
portal. Four OpenAPI definitions are published, covering 242 operations; two further documented
surfaces — the SNYPR `/ws/*` web services and the Spotter search API — have documentation but no
specification.

Base URLs are tenant- or region-specific. Securonix Support supplies the regional base URL; it is
not published.

## Authentication

Two tiers, and picking the wrong one is the most common failure.

- **WS token.** `GET https://<host>/Snypr/ws/token/generate` with request headers `username`,
  `password`, `validity` (days). Returns a bare UUID. Validate with `/ws/token/validate`, extend by
  one day with `/ws/token/renew`.
- **JWT.** `POST https://<region-base>/shared/snypr-service-gateway/api/v2/oauth/token` with header
  `wstoken: <UUID>`. Returns `accessToken` / `refreshToken` with expiries. Send as
  `Authorization: Bearer`. Refresh at `/api/v2/oauth/token/refresh`; revoke at
  `/api/v2/oauth/token/revoke` (requires `ROLE_REVOKE_JWT_TOKEN`).
- Header name varies by service: `token` on `/ws/*` and Device Monitoring, `wstoken` on the
  ingestion service, `Authorization: Bearer` on Policy Management, Spotter and ThreatQ.
- Optional `x-transaction-id` (UUID) for request tracing on the gateway.

## Specifications

- [Policy Management Service API 3.1.4](https://api.swaggerhub.com/apis/securonix-b7a/Securonix_Policy_Management_API/3.1.4): OpenAPI 3.1.0, 10 operations. Create/update/enable/disable/delete detection policies; MITRE ATT&CK threat-coverage metrics and technique details. Base `https://policymanagement.api.securonix.net`.
- [Datasource Onboarding API 1.0.0](https://api.swaggerhub.com/apis/securonix-b7a/Datasource_Onboarding/1.0.0): OpenAPI 3.0.3, 22 operations under `/ingestion/v1/*`. Configure API and Syslog data sources, syslog sources and filters, parsers, resource groups, import jobs.
- [Device Monitoring 1.0.0](https://api.swaggerhub.com/apis/securonix-b7a/Device_Monitoring/1.0.0): OpenAPI 3.0.3, 1 operation. `POST /devicealert/listdevices` — monitored devices and ingestion health.
- [ThreatQ API 1.0.0](https://api.swaggerhub.com/apis/securonix-b7a/ThreatQ/1.0.0): OpenAPI 3.0.0, 209 operations. Indicators, adversaries, events, malware, campaigns, incidents, investigations, signatures, TTPs, vulnerabilities and the polymorphic `/{object_type}/...` attribute/comment/source/tag/watchlist/relationship model. TLP is a first-class object.

## Documented but unspecified

- [REST API Categories](https://documentation.securonix.com/r/content/rest-api-categories.htm) — the SNYPR `/ws/*` surface: Activity, Asset, Geolocation, Incident Management, List, Lookup, Data Dictionary, Risk History, Security Command Center Endpoints, Third-Party Intel, TopN, Users, Violations, Watchlist, Whitelist.
- [Spotter API](https://documentation.securonix.com/r/content/spotter-api.htm) — asynchronous search: POST a query, poll `/status`, page `/results`. Limit default 1000, max 10,000; timeout default 3600s.
- [User Management API](https://documentation.securonix.com/r/content/user-management-api.htm) — `GET /users/{id}`, `/roles/{id}`, `/groups/{id}`.

## Documentation

- [Developer Guide](https://documentation.securonix.com/r/content/developer-guide.htm)
- [Authentication](https://documentation.securonix.com/r/content/authentication.htm)
- [Securonix DELTA Framework](https://documentation.securonix.com/r/content/delta-framework.htm)
- [Release Notes](https://documentation.securonix.com/r/content/release-notes.htm) — Platform, Content, Hub and RIN streams, Cloud and On-Prem, 2024–2026. Current: 6.4 July R1 2026, released 2026-08-25.

Note for crawlers: `documentation.securonix.com/robots.txt` is `Disallow: /`, and the portal is a
Fluid Topics single-page application that returns the same 2,656-byte shell for every path. The
content is real; it is served through the portal's own knowledge-hub API.

## Agent surfaces

- **MCP:** `https://www.securonix.com/wp-json/mcp/mcp-oauth-server` — a live remote MCP server on
  the corporate WordPress site, OAuth 2.1 protected (scope `mcp`, PKCE S256). Discovery at
  `/.well-known/oauth-authorization-server` (RFC 8414) and `/.well-known/oauth-protected-resource`
  (RFC 9728). `tools/list` returns 401 without a token, so the tool set is not public. This server
  covers the web estate, not the SIEM product APIs.
- **A2A agent card:** none. No `/.well-known/agent-card.json` or `/.well-known/agent.json` on any
  Securonix host.
- **SDKs:** none in any public registry.

## Standards

MITRE ATT&CK is declared in the contract (tactic/technique/sub-technique coverage endpoints with a
CSV projection). ThreatQ carries FIRST TLP as a first-class object. STIX/TAXII 2.1 and OCSF appear
as ingest formats. CEF, LEEF and Syslog are pervasive across the connector catalog. Sigma rule
conversion tooling is published in the GitHub org.

## Known gaps

- No idempotency mechanism on any write operation.
- No published rate limit and no `RateLimit-*` / `Retry-After` headers; 429 is declared on 1 of 242 operations.
- No RFC 9457 problem details — all errors are a vendor JSON shape.
- No deprecation or sunset policy, no `Deprecation`/`Sunset` headers, no operation marked deprecated.
- No public status page, no `security.txt`, no trust center, no public pricing.
- Reversal paths exist (disable a policy, remove from whitelist, stop a job, revoke a token) but no reversal window is stated anywhere.

## Company

- [Securonix](https://www.securonix.com/)
- [Blog](https://www.securonix.com/blog/)
- [GitHub](https://github.com/Securonix)
- [Community — Securonix Connect](https://connect.securonix.com/)
- [Support Services](https://www.securonix.com/services/support-services/)
- [Legal Center](https://www.securonix.com/legal-center/)