Lumu’s Custom Collector API allows sending network metadata captured from third-party platforms/services/appliances to Lumu for Continuous Compromise Assessment. It can also be used as an alternative for obtaining greater visibility in cases where the enterprise network restricts the use of Virtual Appliances.

Custom Collector API general deployment architecture.

This article is a quick guide on managing the Custom Collector API for integrating third-party solutions to the Lumu metadata-ingestion engine.

A unique key handles the authentication of the Lumu Custom Collector API. The company’s account key is found in the corresponding area of the Lumu Portal (1). Each custom collector also has a unique ID.

Custom Collector API management area - Lumu Portal.

Note : The revocation process generates a new Custom Collector API key. This action cannot be undone and will cause Lumu to stop storing and processing data for all current custom collectors. This option should be used in specific scenarios such as when your current key is compromised due to security policies, etc. In case a key is revoked, you need to update all current custom collectors configurations with the new API key.

Manage Custom Collectors

To create a custom collector, navigate to the Collectors > API menu of the Lumu Portal and click to add a collector.

In case you need help from someone from your team to configure custom collectors, you can invite someone from your company to the Lumu Portal.

When creating a custom collector, you are required to provide the following information:

1. Name: a name for your custom collector.
   

1. Description: an optional brief description for the custom collector.
   

1. Label: the label with which all the captured metadata will be associated by default. You can later specify grouping rules for a more granular classification.
   

1. Type: the type of metadata you want this custom collector to process.
   

1. Custom collector details include its name, id (unique identifier), labels, description, and data collection statistics.
   

1. Custom collector management options: edit and delete.
   

1. Links for the documentation.
   

1. Records view of the custom collector for the last 30 days.
   

1. Data group rules to add and edit rules (labels) for traffic categorization.
   

Be aware that any edit made to an existing collector affects only the data collected after the changes are made and does not apply to any data already collected.

In this area, you also have the option to delete a collector.

The deletion process cannot be undone and should be used to remove the collector permanently. In case a custom collector is deleted, you need to update the API configurations with the new collector ID.

Working With Grouping Rules

Grouping Rules are powerful tools to organize and streamline the traffic received by your collectors by making full use of Lumu’s Labels. Consult the relevant article on our technical documentation to learn more about Grouping Rules.

To understand the API methods available to send your infrastructure metadata to be analyzed by Lumu, see our documentation.