RocketCyber: connect, sync incidents and coverage, map customers

RocketCyber is your managed-SOC layer — the 24/7 watch on your customers' endpoints and the incidents it catches. This connector reads that story out of RocketCyber and hangs it off the matching Current company: how many endpoints are under watch, how many security apps are enabled, and the incident posture per customer. It feeds your executive and CIO business reviews. It is read-only in the strictest sense: Current reads RocketCyber and can never change anything in it — the Customer API has no write endpoints at all.

RocketCyber's Customer API uses a single Bearer token that is scoped to the account tree it belongs to — the data Current pulls is exactly the data that token can see. Generating it is an admin action inside the RocketCyber web app.

1. 1
   1 · Open the RocketCyber app as an administrator

   Sign in to RocketCyber. Generating an access token is a customer/administrator action — follow Kaseya's helpdesk article "Customer API - Finding Access Token" for the exact screen, which Kaseya keeps current as the UI changes.
2. 2
   2 · Generate the access token

   Create (or copy) the Customer API access token. It is long-lived and does not expire on a timer — you regenerate it in-app if you ever need to rotate it. A single token carries its own account scope, so pick the token whose tree covers the customers you want in Current.
3. 3
   3 · Copy the token now

   Copy the token before you leave the page. Current stores it server-side only and never shows it back, so keep your own copy until the connection tests green.
4. 4
   4 · Note your region

   RocketCyber runs on regional hosts — Production-US and Production-EU. It must match where your RocketCyber account lives; the wrong region can't see your data.

1. 1
   Open the RocketCyber card

   In Current's left sidebar open Integrations (it sits under Admin, so Tenant Admins have the link), find the RocketCyber card in the Reporting integrations section.
2. 2
   Pick the region, paste the token

   Choose Production-US or Production-EU, then paste your Customer API token into the API Token field.
3. 3
   Press Test connection

   Current makes one live read of your account roster to prove the token works before storing anything. A bad token or the wrong region is rejected on the spot with the real reason. On success the token is stored server-side only — the browser never sees it again — and the card shows how many accounts it found.

The sync runs every 6 hours on its own, and Sync now covers the impatient path. Each run walks your account roster, agent list, enabled security apps, and incident counts, then writes value-signals — never a raw incident firehose.

RocketCyber's Customer API is inherently view-only — the published collection is entirely GET, with no create, update, or delete endpoints anywhere. On top of that, every request Current makes passes through a read-only guard that only permits the four specific reads it needs: the account roster, the agent list, the enabled-apps list, and the incident list. Nothing else is reachable, even by a code bug. Current cannot write to RocketCyber.

In RocketCyber a customer is an Account, identified by its accountId (with a hierarchy path like 2.4.123 from the MSP root down to the customer). Current matches each account to one of your Current companies automatically by normalized name — lowercased, with punctuation and Inc/LLC/Ltd-style suffixes stripped — and links it only when exactly one company matches. Anything it can't match confidently is left for you.

• ＋Unmatched accounts appear on the RocketCyber card's mapping panel — press Map to pick the right Current company by hand.
• ＋A manual mapping is never overwritten by the auto-matcher on a later sync, and neither is a manual unlink.
• ＋Unmapped accounts still sync — their agent and incident counts are stored — but the data only appears on a company once the account is mapped to it.