AlienVault® USM Anywhere™

Configuring the AlienApp for Box

Role Availability Read-Only Analyst Manager

Connected through the Box application programming interface (API), the AlienApp for Box uses a predefined scheduler job to collect information from Box every 20 minutes, such as authentication events, user profile updates, user state changes, application and group assignment, and Box platform changes. After USM Anywhere collects and analyzes the first of these events, you can view them in Activity > Events and the Box dashboard.


  • You must have access to your Box Enterprise account for configuring the integration with the AlienApp for Box.
  • The USM Anywhere Sensor you want to use for the AlienApp for Box must have outbound connectivity to on port 443.

To enable the AlienApp to connect to the Box API

  1. In USM Anywhere, go to Data Sources > Integrations.
  2. Click the AlienApps tab.

    Available Apps tab

  3. On the AlienApps page, click the Box tile.

    The Status tab displays showing that the app is disabled.

  4. If you have more than one deployed USM Anywhere Sensor, select the sensor that you want to use for the enabled AlienApp.

    AlienApps operate through a deployed sensor and use APIs to integrate with the connected third-party technology. Select the sensor that can access the integration endpoint. The HTTPS connections to the API will originate from this sensor, so it is important to make sure the sensor has network access to the AlienApp API endpoints.

  5. Click Enable.

    The Status tab refreshes and displays information about integrating with the Box API.

  6. Copy the Box App Client ID value to be used in your Box Enterprise account.

  7. Log in to the Box Admin Console.
  8. Authorize the AlienApp for Box to access your Box Enterprise account. For assistance, follow the Box documentation, Enabling Custom Built Applications.

    The authorization grants these permission to the AlienApp:

    • Read and write all files and folders stored in Box
    • Manage enterprise properties
    • Admin can make calls on behalf of Users
    • Manage users
    • Manage app users
    • Generate Tokens
  9. For the API Key, enter the Box App Client ID copied above.

    Under Custom Applications, after the authorization succeeds, the USM Anywhere AlienApp for Box appears.

  10. In the Admin Console menu, click Account & Billing.
  11. Locate the Enterprise ID field and copy the value to be used in USM Anywhere.
  12. Return to the AlienApp for Box page in USM Anywhere and click the Settings tab.
  13. Enter the Box Enterprise ID copied above and click Save.

  14. Click the Status tab to verify the connection.

    If the icon appears, there is a problem with the connection. The Message column provides information about the issue. Repeat the steps to fix the configuration or troubleshoot your Box Enterprise account.

  15. In the USM Anywhere main menu, go to Settings > Scheduler and search for the collection job for Box on your sensor.
  16. Enable the job or jobs if they are not already enabled.

    Important: The AlienApp will not work if the scheduler job is not enabled.

    When this job runs for the first time after the connection, it collects Box events from the previous 24 hours. On subsequent runs (every 20 minutes), it only collects new events since the last check.