Credential Management

The System | INTEGRATIONS | Credential Management page lets you configure third-party credentials that the Stellar Cyber Platform uses for threat enrichment during phishing email triage and Alert Auto Triage. You can configure credentials for VirusTotal, a widely used threat intelligence provider; for URLscan.io, a service that scans and analyzes URLs; and for Microsoft Graph, which lets Alert Auto Triage retrieve Microsoft Defender for Endpoint telemetry.

This topic covers the following sections:

The automatic triage of user-reported phishing is only supported on Stellar Cyber in SaaS deployments and requires an add-on license, which you can request from your Stellar Cyber Partner Success representative. If you used this feature through participation in the Early Access Program, contact your Partner Success representative to continue with an add-on license or to request that the service be disabled.

When a credential for VirusTotal is configured and assigned to a tenant, the platform uses it to query the VirusTotal Premium API during triage. This enhances observables—such as URLs, domains, and attachments—with additional context, increasing the accuracy and confidence of threat assessments.

A VirusTotal Premium API account is required. Free-tier API keys are not supported for Auto Triage enrichment.

When a credential for URLscan.io is configured and assigned to a tenant, Stellar Cyber uses it to query the URLscan.io API during triage. This enriches URL observables with scan results and verdicts that characterize the behavior and reputation of the URL and the site behind it, increasing the accuracy and confidence of threat assessments.

When a Microsoft Graph credential is configured and assigned to a tenant, Alert Auto Triage uses it to query the Microsoft Graph Security API and retrieve Microsoft Defender for Endpoint telemetry dynamically during triage investigations.

Adding a VirusTotal Credential

To configure a new VirusTotal credential:

  1. Navigate to System | INTEGRATIONS | Credential Management and select + Create.

  2. On the Create Credential page that appears, select Create under VirusTotal.

    Screen capture of the Create Credential page with the available credential types

    This opens the Create Credential dialog box.

  3. Enter the following and then select Create:

    Name: Enter a unique, descriptive name for the credential. This name appears later when selecting a VirusTotal credential in an Auto Triage configuration.

    Tenant: Select the tenant to which this credential applies. Only triage runs for the selected tenant use the credential. If you are a super admin, you can assign the credential to All Tenants.

    API Key: Enter the API key from your VirusTotal Premium account into this field. This key is required for the Stellar Cyber Platform to authenticate its queries and perform external enrichment through VirusTotal.

    A VirusTotal Premium API account is required. Free-tier API keys are not supported for Auto Triage enrichment.

    Screen capture of the Create Credential settings

    The new credential appears in the Credential Management table and is available for selection in Auto Triage configurations.

Adding a URLscan.io Credential

A URLscan.io credential lets Stellar Cyber submit URL observables that are encountered during triage to the URLscan.io scanning service and retrieve the resulting analysis. The scan results characterize the behavior and reputation of the URL and the site behind it, adding context that increases the accuracy and confidence of verdicts on URL-based threats.

To configure a new URLscan.io credential:

  1. Navigate to System | INTEGRATIONS | Credential Management and select + Create.

  2. On the Create Credential page that appears, select Create under URLscan.io.

    Screen capture of the Create Credential page with the available credential types

    This opens the URLscan.io Credential page.

  3. In the General section, enter the following:

    Name: Enter a unique, descriptive name for the credential. This name identifies the credential within the Stellar Cyber UI.

    Tenant: Select the Stellar Cyber tenant to which this credential applies. Only triage runs for the selected tenant use the credential. If you are a super admin, you can assign the credential to All Tenants.

  4. In the Authorization section, enter the following:

    API Key: Enter the API key generated for your URLscan.io account. Stellar Cyber presents this key to authenticate its requests when it submits URLs for scanning and retrieves the scan results.

    Screen capture of the URLscan.io Credential settings

  5. Select Create.

    The new credential appears in the Credential Management table, and triage runs for the assigned tenant use it for URL enrichment through URLscan.io.

Adding a Microsoft Graph Credential

A Microsoft Graph credential lets Alert Auto Triage query the Microsoft Graph Security API to retrieve Microsoft Defender for Endpoint telemetry dynamically during triage investigations. The credential identifies an application that you register in Microsoft Entra ID. Stellar Cyber uses the application identity to request an OAuth 2.0 access token from Microsoft and then uses that token to run its Graph Security API queries.

Before you create the credential, register an application in Microsoft Entra ID and grant it the following Microsoft Graph application permissions with admin consent:

  • SecurityAlert.Read.All: Lets Stellar Cyber read the Microsoft Defender alerts that are associated with the case under triage.

  • ThreatHunting.Read.All: Lets Stellar Cyber run advanced hunting queries that retrieve Microsoft Defender for Endpoint telemetry.

For instructions on registering an application, refer to Register an application with the Microsoft identity platform in the Microsoft documentation.

As an alternative to creating a separate Microsoft Graph credential, you can extend the permission scope of the application used by an existing Microsoft Graph Security API connector to include ThreatHunting.Read.All. If Microsoft Graph credentials are configured both on the Credential Management page and in a connector, Alert Auto Triage uses the credential configured on the Credential Management page.

To configure a new Microsoft Graph credential:

  1. Navigate to System | INTEGRATIONS | Credential Management and select + Create.

  2. On the Create Credential page that appears, select Create under Microsoft Graph.

    Screen capture of the Create Credential page with the available credential types

    This opens the Microsoft Graph Credential page.

  3. In the General section, enter the following:

    Name: Enter a unique, descriptive name for the credential. This name identifies the credential within the Stellar Cyber UI.

    Tenant: Select the Stellar Cyber tenant to which this credential applies. Only triage runs for the selected tenant use the credential. If you are a super admin, you can assign the credential to All Tenants.

  4. In the Authorization section, enter the following values from the application that you registered in Microsoft Entra ID:

    Client ID: Enter the application (client) ID that Microsoft Entra ID assigned to the registered application. This value is also known as the Application ID. It identifies the application when Stellar Cyber requests an access token.

    Client Secret: Enter the client secret value that you generated for the registered application. Stellar Cyber presents this value together with the Client ID to authenticate the token request.

    Microsoft Tenant ID: Enter the directory (tenant) ID of the Microsoft Entra tenant in which the application is registered. This value is also known as the Directory ID and determines the Microsoft tenant from which Stellar Cyber requests the access token.

    The Microsoft Tenant ID identifies your organization in Microsoft Entra ID. It is not related to the Tenant field in the General section, which identifies a Stellar Cyber tenant.

    Screen capture of the Microsoft Graph Credential settings

  5. Select Create.

    The new credential appears in the Credential Management table, and Alert Auto Triage uses it to retrieve Microsoft Defender for Endpoint telemetry for the assigned tenant.

Using the Credential Management Table

The table on the Credential Management page displays all configured credentials. Each row corresponds to one credential and includes the following columns:

  • Name: The user-defined name for the credential.

  • Vendor & App: Identifies the associated service, such as virustotal.

  • Tenant: Indicates which tenant (or All Tenants) is allowed to use the credential.

  • Created Time: Timestamp when the credential was created.

  • Last Modified: Timestamp of the most recent update to the credential.

  • Actions: Includes icons for two actions:

    • Edit: Opens the credential in a dialog to change the name, tenant, or authorization values.

    • Delete: Permanently removes the credential from the system.

Screen capture of the Credential Management page

Editing a Credential

To update a credential:

  1. Select the Edit icon in the Actions column.

  2. Modify the Name and the API Key or Authorization field values as needed.

    The Tenant field cannot be modified after the credential is created. This is by design to ensure tenant-level isolation and integrity of access controls by preventing credentials from being reassigned across tenant boundaries.

  3. Select Save to apply changes.

    All edits take effect immediately and are reflected in the Credential Management table.

Deleting a Credential

To delete a credential, select the Delete icon in the Actions column and then confirm the deletion when prompted.

If the credential is in use—for example, in an Auto Triage Configuration—deleting it will interrupt threat enrichment. Assign a replacement credential first, if needed.