Skip to main content

Agile Blue

Agile Blue is a managed security operations (SOC/MDR) service. This connector brings in the endpoints that report to Agile Blue, with the time each last checked in.

Beta. This connector uses the Agile Blue portal’s interface because Agile Blue has no public API yet, so it may change or fail without notice. If something looks wrong, contact [email protected].

At a glance

Data providedDevices
AuthenticationPortal access token (valid for 24 hours)
Where to configureConnectors → Add a Connector → Agile Blue

Required permissions

Navigator only reads the device list. Agile Blue has no public API yet, so the connector uses the same access token the Agile Blue portal uses. That token carries the access of the portal user who signed in, so use a dedicated user with the Analyst (read) role rather than an administrator.

Setup

  1. Sign in to the Agile Blue portal as the user the connection should use.
  2. Copy the access token the portal sends with its requests: open your browser’s developer tools, go to Network, select any request to api.agileblue.com, and copy the value after Bearer in its Authorization header.
  3. In Navigator, go to Connectors → Add a Connector → Agile Blue.
  4. Paste the token and save. Navigator enqueues a first sync immediately.

The token is valid for 24 hours. When it expires the next sync fails with “the source rejected the saved credentials”; sign in to the portal again, copy a new token, and save it on the connector’s credentials page. Navigator never stores your password or authenticator code.

What data this connector provides

  • Devices: every workstation and server that has checked in during the current or the previous three months, with its hostname, operating system and the time it last checked in. Devices with no agent update time in Agile Blue are skipped. Devices renamed in Agile Blue stay a single device in Navigator.
  • Agent details, shown as Agile Blue fields on the device and available in searches: Agile Blue agent version and status, last agent update (time and version), Elastic Agent version and status, Elastic Endpoint status, and Fleet status. Agile Blue reports a version for the Agile Blue agent and the Elastic Agent only; Elastic Endpoint and Fleet have a status but no version.

Every device reported by this connector is treated as having agent-based coverage.

Known limitations

  • The token must be replaced about every 24 hours until Agile Blue offers a long-lived API credential.
  • Agile Blue does not return serial numbers, MAC addresses, IP addresses or hardware details, so devices are matched to other sources by hostname.
  • Log-source integrations (such as Entra ID, Azure and Microsoft 365) and network devices that send syslog are not imported as devices.
  • Agile Blue device tags are not shown in Navigator yet.
Next → Azure