Reco
Visualize changes to Reco Accounts, Users, Identity Users, Identity Accounts, Policies, Devices, Applications, and Alerts through queries and alerts.
- Installation
- Data Model
- Types
Reco Integration: Installation Guide
Overview
This guide helps you set up the Reco integration to ingest data into the JupiterOne platform.
Prerequisites
Before you begin, ensure you have the following:
- An active Reco account.
- Admin-level access to manage API keys in Reco.
- Access to the JupiterOne portal to create and manage integrations.
Configuration in Reco
Generate API Key in Reco
Reco uses API key-based authentication to authorize access to its APIs. Follow these steps to generate a key:
- Log in to your Reco portal.
- Navigate to Integrations.
- Navigate to API Access Keys
- Click Add API Access Key to generate a new key.
- Provide a descriptive name for the key and click Add.
- Copy and securely save the generated API key.
⚠️ Note: You won’t be able to view the full key again after navigating away from the page.
Once created, your key will appear with a status of active, indicating it's ready for use.
Configure Integration in JupiterOne
-
In JupiterOne, navigate to the Integrations section from the top navigation bar.
-
Search for and select Reco.
-
Click Add Instance and fill in the following fields:
- Reco API Key: Paste the API key generated in Reco.
- Reco Host: Enter your Reco server hostname (e.g.,
example.reco.ai
). - Account Name: Provide a unique identifier for this Reco instance in JupiterOne.
- If the Tag with Account Name option is enabled, entities will include this value in
tag.AccountName
.
- If the Tag with Account Name option is enabled, entities will include this value in
- Description: (Optional) Add a description to help your team identify this integration.
- Polling Interval: (Optional) Choose how frequently the integration should run. Leave as
DISABLED
for manual execution.
-
Click Create Configuration to save the settings.
Next Steps
Your Reco integration instance will now execute according to the configured polling interval and begin ingesting data into JupiterOne.
To manage or update the integration, refer to the Instance Management Guide.
Entities
The following entities are created:
Resources | Entity _type | Entity _class |
---|---|---|
Account User | reco_account_user | User |
Alert | reco_alert | Finding |
Application | reco_application | Application |
Device | reco_device | Host |
Policy | reco_policy | Policy |
Reco Account | reco_account | Account |
Reco Identity Account | reco_identity_account | Account |
Reco Identity User | reco_identity_user | User |
Relationships
The following relationships are created:
Source Entity _type | Relationship _class | Target Entity _type |
---|---|---|
reco_account | HAS | reco_account_user |
reco_identity_account | HAS | reco_application |
reco_identity_user | OWNS | reco_device |
reco_identity_user | HAS | reco_identity_account |
reco_policy | TRIGGERS | reco_alert |
Reco Account
reco_account
inherits from Account
Reco Account User
reco_account_user
inherits from User
Property | Type | Description | Specifications |
---|---|---|---|
isSingleSignOn | boolean | ||
lastLoggedInOn | number | ||
roles | array of string s | ||
ssoAppIds | array of string s |
Reco Alert
reco_alert
inherits from Finding
Property | Type | Description | Specifications |
---|---|---|---|
extractionSource | string | ||
instanceId | string | ||
lastExtractedOn | number | ||
lastScannedOn | number | ||
tenantId | string | ||
totalComments | number |
Reco Application
reco_application
inherits from Application
Property | Type | Description | Specifications |
---|---|---|---|
appCreatedAt | number | ||
appGroups | array of string s | ||
applicationInstances | array of string s | ||
applicationName | string | ||
appOwner | array of string s | ||
authorizationStatus | string | ||
authTypes | array of string s | ||
bkBreachIndex | number | ||
bkBreachIndexLastUpdatedOn | number | ||
bkCyberRating | number | ||
bkCyberRatingLastUpdatedOn | number | ||
bkGradeLetter | string | ||
bkRansomwareIndex | number | ||
bkRansomwareIndexLastUpdatedAt | number | ||
category | string | ||
companySize | string | ||
firstUsedOn | number | ||
isShadow | boolean | ||
isSsoEnabled | boolean | ||
lastThirtyDaysScore | number | ||
lastUsedOn | number | ||
logo | string | ||
numberOfUsers | number | ||
overrodeUsage | string | ||
securityScore | number | ||
securityScoreLetter | string | ||
securityScoreUrl | string | ||
tenantId | string | ||
typeUsage | string | ||
unusedApp | boolean | ||
usesAI | boolean | ||
vendor | string | ||
website | string |
Reco Device
reco_device
inherits from Host
Property | Type | Description | Specifications |
---|---|---|---|
accountId | string | ||
hasIdentity | boolean | ||
instanceId | string | ||
isRegistered | boolean | ||
lastApiMessageId | string | ||
managementStatus | string |
Reco Identity Account
reco_identity_account
inherits from Account
Property | Type | Description | Specifications |
---|---|---|---|
accountType | string | ||
adminLabel | string | ||
adminLabelUpdatedAt | number | ||
alerts30Days | number | ||
alertsCount | number | ||
deactivatedOn | number | ||
domainType | string | ||
email | string | ||
hasMfa | boolean | ||
instanceId | string | ||
isActive | boolean | ||
isAdmin | boolean | ||
isGuest | boolean | ||
isInternal | boolean | ||
isPrivileged | boolean | ||
isServiceAccount | boolean | ||
isStandard | boolean | ||
lastLoggedInOn | number | ||
lastSeenOn | number | ||
location | string | ||
locationAnalysis | array of string s | ||
numGroups | number | ||
permissions | array of string s | ||
permissionSets | array of string s | ||
photo | string | ||
relatedEmails | array of string s | ||
roles | array of string s | ||
tenantId | string | ||
userTypeDisplay | string | ||
workspaceId | string |
Reco Identity User
reco_identity_user
inherits from User
Property | Type | Description | Specifications |
---|---|---|---|
alertsCount | number | ||
appInstanceIds | array of string s | ||
departments | array of string s | ||
hasAccess | boolean | ||
isFormerUser | boolean | ||
jobTitles | array of string s | ||
labelNames | array of string s | ||
lastLoginOn | number | ||
lastSeenOn | number | ||
relatedAccountCount | number |
Reco Policy
reco_policy
inherits from Policy
Property | Type | Description | Specifications |
---|---|---|---|
openAlerts | number | ||
policyType | string | ||
riskLevel | string | ||
sources | array of string s | ||
status | string | ||
tags | array of string s | ||
totalAlerts | number |