Configuring the BlueApp for Box

Role Availability Read-Only Investigator Analyst Manager

Connected through the Box application programming interface (API), the BlueApp for Box uses a predefined scheduler job to collect information from Box every 20 minutes, such as authentication events, user profile updates, user state changes, application and group assignment, and Box platform changes. After USM Anywhere collects and analyzes the first of these events, you can view them in Activity > Events and the Box dashboard.

Important: You must have access to your Box Enterprise account for configuring the integration with the BlueApp for Box. The USM Anywhere Sensor you want to use for the BlueApp for Box must have outbound connectivity to on port 443.

To enable the BlueApp to connect to the Box API

  1. In USM Anywhere, go to Data Sources > BlueApps.
  2. Click the Available Apps tab.
  3. Search for the BlueApp, and then click the tile.
  4. Click the Instructions tab.
  5. Follow the instructions on the page to obtain the Enterprise ID from Box. This step is better conducted in a different browser.
  6. Click the Configuration tab.
  7. Click Configure API.
  8. If you have more than one deployed USM Anywhere Sensor, select the sensor that you want to use for the enabled BlueApp.

    BlueApps operate through a deployed sensor and use APIs to integrate with the connected third-party technology. Select the sensor that can access the integration endpoint. The HTTPS connections to the API will originate from this sensor, so it is important to make sure the sensor has network access to the BlueApp API endpoints.

  9. In the Box Enterprise ID field, paste the value obtained from Box.
  10. Click Save.
  11. Verify the connection.

    After USM Anywhere completes a successful connection to the Box APIs, a icon displays in the Health column.

    If the icon displays, there is a problem with the connection. The Message column provides information about the issue. Repeat the steps to fix the configuration or troubleshoot your Box connection.

  12. In the USM Anywhere main menu, go to Settings > Scheduler and search for the collection job for Box.
  13. Enable the job if it is not already enabled.

    Important: The BlueApp will not work if the scheduler job is not enabled.

    When this job runs for the first time after the connection, it collects Box events from the previous 24 hours. On subsequent runs (every 20 minutes), it only collects new events since the last check.