Marketplace

Last updated

Oct 15, 2024
Save as PDF

Overview

The Marketplace is innovative community-driven threat intelligence, offering users the ability to install carefully researched, ConnectWise SIEM-produced Perchybana objects, including Dashboards, Visualizations, Event Notifications, and Saved Searches. The Marketplace also allows users to create and share their own Organization’s content publicly and privately. To get content out to SIEM's flock of users, the Marketplace was developed as a first-of-its-kind, living, and continuously growing vault of Perchybana (Elastic) Objects to which user Organizations are highly encouraged to contribute. SIEM loves open source!

Marketplace Sharing

The Marketplace is divided into two methods of sharing: Public and Exclusive (a.k.a Private).

Public: In the Marketplace, your Public Collection is one that your Organization is outwardly and openly sharing with the rest of the user base on SIEM. This is meant for Perchybana Objects your Organization has designed that you want to let other members of SIEM observe and use. This is best saved for Perchybana Objects you create around some general or specific searching of different logs/Index Patterns but does not contain personally or proprietarily identifiable information of any kind from your Organization.
Exclusive: Your Organization’s Exclusive Collection is for sharing and installing Perchybana Objects that only you can see. Managed Service Providers can create Exclusive/Private Collections that can Auto-Install objects shared to all of their customers in SIEM, turning it into an effective “network share” in the SIEM portal for Perchybana Objects. No one else has any access to this Exclusive/Private Collection.

Note: Sharing any Perchybana Object to your Organization’s Exclusive Collection installs the Object for every member of that Organization. It would take the configuration of Auto-Install for an MSP to have all of their Objects shared to their Exclusive Collection install for all members of all their customers.

Accessing Marketplace

To access the Marketplace:

Log in to SIEM and on the left side, click on Marketplace.
Select Explore to discover and install new Perchybana content from Collections. Select Manage to share Perchybana Objects with your Organization and Managed Organizations, or the public SIEM user community.

Explore

Collections and the Popular page are available in the Explore tab. Collections represent groupings of content pieces that focus on one theme, technology, or larger significant grouping. You can find collections focused on Windows, Microsoft 365, Cisco, Auduitbeat Linux, AWS, Compliance, SIEM team collections, and others from Public Collections.

Popular Tab

Use the Popular view to see the six most-installed content pieces across all SIEM users for each Perchybana object type: Dashboards, Visualizations, Event Notifications, and Saved Searches.
You can use the filter area on the top of the Popular page to do a specified search across all Perchybana objects in the Marketplace.
Filter by Add-on/Object Type, whether or not you already have the object installed, and whether objects are Public or Exclusive to your Managed Organization.
You can also use the button next to the object type title to show all the Perchybana objects of that type. For example, click See All next to Dashboards to see all the existing Dashboards on the SIEM Marketplace.

Manage

This part of the Marketplace is for sharing any Perchybana Objects with your Organization, managed Organizations, or the Public SIEM user community.

Click Start Sharing on your Public or Exclusive Collection to open the Collection’s Details page.
- You won't see the Start Sharing button if you’ve already created either a Public or Managed Organization (Exclusive) type Collection. Instead, use Create Collection to start a new Collection object for your Organization.
- You have the following settings to configure:
  - Sharing – the type of Collection, Public or Managed Organization (Exclusive).
  - Collection name – the effective title for the Collection.
  - Collection description.
- Scroll down to the Perchybana Object Type sections and choose one to begin Sharing.
  - You can also use the Search Bar in any Object Type section to find what you’re looking for quickly.
- Find the specific Object you want to share, click the Share icon, and verify the Share in the pop-up window.
  - Performing this Share effectively pulls the Perchybana Object from the account it’s being Shared from and installs that version to all members of the Organization that the account is a part of, depending on permissions. You can also Auto-Install to all your Managed Organizations.
  - Use the checkmark-style boxes to choose all items or specific items and install the total number of Objects in a group. Use the Share Multiple button in the top right of the Object Type section to Share the Objects all at once.
- On a Collection’s Details page, open up any Perchybana Objects from any of their object type groupings with the Details button.
  This automatically opens the Object in a new browser tab so you can verify the following details.
  - Dashboard
  - Visualization
  - Event Notification
  - Saved Search

Using Marketplace

Here are the functions you’ll need to actually use the Marketplace:

Details – This button lives on Collections and opens them up to show all the different Perchybana Objects which that Collection contains.
Install/Manage – These buttons are visible depending on whether you have installed the Perchybana Object.
- Install – This opens a small window asking you to verify the Installation and whether you want to Install the Object for all your Managed Organizations.
- Manage –The Manage window configures whether or not you are using Auto-Install for your Managed Organizations, the total number of your Managed Organizations that have that Object, and an Uninstall option.
Uninstall – Within a Manage window, this button uninstalls an Object from your Organization and from any Managed Organizations you may have been using Auto-Install with.
See All – Click to see all the Perchybana Objects within that filter/section. Marketplace only displays a certain number of Objects per page section.
Install – You can choose to Install an entire Collection if you wish, instead of the individual Perchybana Objects it contains. You can also use the Auto-Install function for entire Collections.

Things to know

Note: When a user in any Organization shares to the Marketplace, they are allowing the Perchybana Object they shared to be Installed by members of other Organizations. This also means that the Perchybana Object is locked to the version the user originally shared. Any attempts to update the Installed version of any Perchybana Object overwrite the original settings of the Object shared by the user.

For anything you share publicly on the Marketplace, ensure that it does not contain personally or proprietary identifiable information of any kind from your Organization.
A green Auto-Install notification indicates you are using Auto-Install for your Managed Organizations.
- Sharing any Perchybana Object to your Organization’s Exclusive Collection installs the Object for every member of that Organization. For an MSP to have all of their Objects shared to their Exclusive Collection installed for all members of all their customers, it would take the configuration of Auto-Install.
- You can also use the button next to the object type title to show all the Perchybana objects of that type.
  - Example: Click See All next to Dashboards to see all the existing Dashboards on the Marketplace.
You must perform a clone function to recreate, update, or change any Perchybana Objects you have Installed from the Marketplace.
This effectively recreates the Perchybana Object under your user ownership and allows you to update any part of the object.
The Marketplace rapidly continues to grow and expand its breadth of knowledge and ability to find threats in your networks. More Organizations have been deciding to open up Public Collections with general-use items they have found effective and sharing these with the rest of the flock. Please let us know if there is anything at all we can do to improve your Marketplace experience. Contact help.siem@connectwise.com for more information.