Skip to main content

Hello all,

I know that typically integrations are built with the use of a secret that is static and is saved in an integration instance's parameters. 

How would one handle feeding a secret for one SaaS' API that gets rotated and stored in the key vault of a different product (which would be available via that product's API) - so e.g. getting password from AWS KMS to use in an API call to Tenable? The only way that comes to mind is creating a custom action that does both steps within the one action.

Hey @donkos


We do have a similar use case implemented for Azure integrations. Inside of those integrations, there is a Job that will update the Integration Configuration. My suggestion would be to check, how it's done there and then create a job that will scan the AWS KMS and if needed, update the configuration of the integration.


In my opinion, this would be the most straightforward way of solving your use case. 


Hey @donkos


We do have a similar use case implemented for Azure integrations. Inside of those integrations, there is a Job that will update the Integration Configuration. My suggestion would be to check, how it's done there and then create a job that will scan the AWS KMS and if needed, update the configuration of the integration.


In my opinion, this would be the most straightforward way of solving your use case. 


Are you referring to the Refresh Token job? I would appreciate a more detailed explanation on how that type of job works in SOAR.


Are you referring to the Refresh Token job? I would appreciate a more detailed explanation on how that type of job works in SOAR.


@donkos Yes, this is the job. The most important methods:


_build_manager_for_instance - fetches current configuration and builds the integration instance that needs to be updated.



_refresh_integration_token - updates the integration instance configuration. In this case, it updates the "Refresh Token" parameter.




_refresh_connector_token - updates the connector configurations (integration and connector configurations are not shared)





Reply