You can configure Cisco Panoptica to send event information to Ops Genie, from where you can view it. This includes events such as a workload starting in an environment, or being blocked; connections being established between workloads, or closed.

Configure Ops Genie

Panoptica is configured as a Team in Ops Genie.

1. Log in to Ops Genie, and select Teams, in the navigation pane on the left.
2. Click Add team.

3. Enter a name for the team (for example, Panoptica), and then click Add.
4. Select Integrations.

5. Click Add integration, and then select API (Rest API HTTPS over JSON.).

6. In the Settings section, enter a Name for the integration (for example, Panoptica_API).
7. Copy the API Key value.

8. Select Read, Create and Update, and Delete Access.
9. Click Enabled.
10. Leave Tags and Extra Properties unchanged.
11. Click Save Integration.

Configure Panoptica

1. In the Panoptica console, navigate to the System page, and then select the INTEGRATIONS tab.
2. Scroll to the EVENTS FORWARDING section, and click New Events Forwarding.
3. Select type Ops Genie.

4. Enter the following details for Ops Genie:

   • the API Key, copied from the setup on Ops Genie, above, as the Token.

5. Select which events will be sent to Ops Genie:

   • Notifications - these are non-critical events, that do not violate any Panoptica policy , such as a workload starting, or a connection established
   • Alerts - these are events that violate a Panoptica policy; the action may be blocked, depending on the rules in the policy.

View events on Ops Genie

To view Panoptica events on Ops Genie, select Alerts in the Navigation pane.

Use the search bar (the black box) to query for specific events, or use saved searches.
Click on an event to see more detail for it.