Kaseya MDR (RocketCyber): connect, sync incidents and Microsoft 365 events

RocketCyber is your managed-SOC layer, the 24/7 watch on your customers' endpoints and the incidents it catches. This connector reads that story out of RocketCyber and hangs it off the matching Current company: how many endpoints are under watch, how many security apps are enabled, and the incident posture per customer. It feeds your executive and CIO business reviews. It is read-only in the strictest sense: Current reads RocketCyber and can never change anything in it. The Customer API has no write endpoints at all.

RocketCyber's Customer API uses a single Bearer token that is scoped to the account tree it belongs to. The data Current pulls is exactly the data that token can see. Generating it is an admin action inside the RocketCyber web app.

1. 1
   1 · Open the RocketCyber app as an administrator

   Sign in to RocketCyber. Generating an access token is a customer/administrator action, follow Kaseya's helpdesk article "Customer API - Finding Access Token" for the exact screen, which Kaseya keeps current as the UI changes.
2. 2
   2 · Generate the access token

   Create (or copy) the Customer API access token. It is long-lived and does not expire on a timer. You regenerate it in-app if you ever need to rotate it. A single token carries its own account scope, so pick the token whose tree covers the customers you want in Current.
3. 3
   3 · Copy the token now

   Copy the token before you leave the page. Current stores it server-side only and never shows it back, so keep your own copy until the connection tests green.
4. 4
   4 · Note your region

   RocketCyber runs on regional hosts, Production-US and Production-EU. It must match where your RocketCyber account lives; the wrong region can't see your data.

1. 1
   Open the Kaseya MDR (RocketCyber) card

   In Current, open Settings › Integrations (Tenant Admins only), find Kaseya MDR (RocketCyber) under Security.
2. 2
   Pick the region, paste the token

   Choose Production-US or Production-EU, then paste your Customer API token into the RocketCyber API token field. If you use Kaseya MDR, paste the Kaseya API key too (see the next section); it is optional.
3. 3
   Press Test connection

   Current makes one live read of your account roster to prove the token works before storing anything. A bad token or the wrong region is rejected on the spot with the real reason. On success the token is stored server-side only (the browser never sees it again), and the card shows how many accounts it found.

The sync runs every 6 hours on its own, and Sync now covers the impatient path. Each run walks your account roster, agent list, enabled security apps, and incident counts, then writes value-signals, never a raw incident firehose.

RocketCyber's Customer API is inherently view-only. The published collection is entirely GET, with no create, update, or delete endpoints anywhere. On top of that, every request Current makes passes through a read-only guard that only permits the four specific reads it needs: the account roster, the agent list, the enabled-apps list, and the incident list. Nothing else is reachable, even by a code bug. Current cannot write to RocketCyber. The Kaseya key works the same way for reading: the sync may only sign in, read events, read automatic responses and read a job's result.

Kaseya MDR runs on RocketCyber, and its newer API adds two things the Customer API cannot give you: Microsoft 365 security events per customer, and the automatic responses Kaseya holds until someone approves them. To read them, paste a Kaseya API key on the same card.

1. 1
   1 · Copy the key in Kaseya MDR

   In the Kaseya MDR console open Settings, then API, and press Show API Key. Copy the key.
2. 2
   2 · Paste it on the card

   Open the Kaseya MDR (RocketCyber) card, paste the key into Kaseya API key, and press Test connection. Current checks the key with one call to Kaseya and stores it server-side only. A wrong key is refused with the reason, and RocketCyber keeps working either way.
3. 3
   3 · Read What we found

   After the next sync (or Sync now) the card lists what Current found: whether each key works, how many organizations Kaseya lists and how many still need a company, how many have Microsoft 365 connected, need permissions upgraded or reconnecting, or are not connected, how many critical or medium events arrived in the last 30 days, and how many automatic responses are waiting.

• Saving the card again with the Kaseya field empty keeps the key you saved before. To take it away, press Remove Kaseya key.
• Current checks Kaseya for automatic responses every 10 minutes, so a response waiting for approval shows up quickly. The card says "Instant alerts not available; checking every 10 minutes" until Kaseya can deliver to Current directly.
• Current reads every organization in your Kaseya MDR console, not only the ones with recent events, and matches each to one of your companies by name, like RocketCyber accounts. Anything unmatched appears in the same mapping panel.
• Kaseya can only read events for an organization whose Microsoft 365 connection is healthy. If the card shows many organizations that need permissions upgraded or reconnecting, fix them in the Kaseya MDR console (Microsoft 365 connections), then press Sync now.

In RocketCyber a customer is an Account, identified by its accountId (with a hierarchy path like 2.4.123 from the MSP root down to the customer). Current matches each account to one of your Current companies automatically by normalized name (lowercased, with punctuation and Inc/LLC/Ltd-style suffixes stripped), and links it when exactly one company matches. When two or more of your companies share that name and the names differ only by a suffix like Inc or LLC, Current links the one that is an active customer, or, if none of them is, the one linked to your PSA. Anything still tied or unmatched is left for you.

• Unmatched accounts appear on the RocketCyber card's mapping panel, press Map to pick the right Current company by hand.
• A manual mapping is never overwritten by the auto-matcher on a later sync, and neither is a manual unlink.
• Unmapped accounts still sync (their agent and incident counts are stored), but the data only appears on a company once the account is mapped to it.