Overview
Connect Blumira to your ConnectWise PSA (formerly Manage) account to send Blumira finding notifications and updates directly to your ticketing system. With this integration, reduce manual work spent merging tickets about the same finding, assigning priorities and people, and other administrative tasks that take time away from focusing on the security of your customers.
After connecting Blumira to your PSA account and service boards, Blumira will create a new ticket in ConnectWise for all new findings and then update the same ticket when someone adds a comment or resolves the finding in Blumira. Each ticket contains a link to the finding in the Blumira app, where you will review the matched evidence, complete workflows, and resolve the finding.
One-way data synchronization
Currently, data and updates are not synced from ConnectWise back to Blumira when service tickets are updated, such as when assigned or closed. Users need to log in to Blumira to answer workflow questions and resolve findings, then those updates will sync to the related service ticket.
The PSA integration does not include these other types of notifications:
- Executive Summaries
- Billing or invoice emails
- MSP agent limit exceeded emails
- Sensor offline/health alerts
- Cloud Connector health alerts
Before you begin
Required: You must have a paid partner contract with Blumira to use the PSA integration to send finding notifications for your sub-accounts. If you are an MSP on a free trial with no paying accounts, you can trial the PSA integration for the parent account, which is your MSP Portal. There is no option to trial it on a sub-account.
To configure Blumira's ConnectWise PSA integration, complete the following procedures:
- Creating a new service role in ConnectWise
- Creating a new API member and gathering the public and private keys
- Configuring Blumira
Creating a new service role in ConnectWise
To create a new service role in ConnectWise, do the following:
- Log in to your ConnectWise account.
- Navigate to System > Security Roles.
- On the Security Roles page, click Add (+).
- In the Role ID field, type a name, such as “BlumiraAPIRole,” that indicates the security role is for Blumira’s API integration.
- Click Save.
- In the Security Modules for Role screen, update the following sections:
-
Expand Companies and then, in the Company Maintenance row, under Inquire Level, select All.
- Expand Service Desk and do the following:
- In the Close Service Tickets row, select All in these columns:
- Edit Level
- Inquire Level
- In the Service Ticket - Dependencies row, select All in these columns:
- Add Level
- Edit Level
- Inquire Level
- In the Service Tickets row, select All in these columns:
- Add Level
- Edit Level
- Inquire Level
- In the Close Service Tickets row, select All in these columns:
- Expand System and then do the following:
- Next to Table Setup, click customize.
- In the Update Security window, keep only the following options in the "Allow Access to these" box:
- Company / Company Status
- Service / Priority
- Service / Service Board
- Service / Severity
- Service / Source
- Click Save.
- Back in the Table Setup row, under the Inquire Level column, select All.
- Next to Table Setup, click customize.
-
Expand Companies and then, in the Company Maintenance row, under Inquire Level, select All.
- Ensure that all other module options are set to None, which is the default.
- Click Save (disk icon) above the table.
Creating a new API member and gathering the public and private keys
Create a new API member user by doing the following:
- In CWM, navigate to System > Members.
- Click the API Members tab.
- In the API Members section, click the add button “+” to add a new API Member for the Blumira integration.
- In the Member ID field, type an identifier, such as “Blumira API,” to help you identify the member within your account.
- In the Member name field, type a name, such as “Blumira Automation,” that will appear as the display name on tickets.
- Under System, in the Role ID field, select the BlumiraAPIRole you created in the previous steps.
- Update all other required fields in the System section according to your deployment needs.
- (Optional) Under Service Defaults, you can optionally choose a default service board but do not need to select a default here. You will select the service board in later steps when configuring Blumira, below.
- Click Save and stay on page (the disk icon near the top of the screen).
- Navigate to the API Keys tab of the member you created above.
- Click Add (+).
- In Description, type a description, such as “Blumira Integration,” and then click Save.
- Copy and save the Public Key and Private Key to use when configuring Blumira.
Note: If you lose the private key, and either mistype or otherwise hit errors when configuring Blumira, you must generate a new key pair for the API member and provide the new values to Blumira. Only the public key will appear in ConnectWise after closing the API Keys tab.
Configuring Blumira
To configure the integration with ConnectWise ticketing, do the following:
- Log in to Blumira.
- Navigate to MSP Portal > MSP Integrations.
- Click Add MSP Integration and then select ConnectWise.
- In the MSP Integration Details window, click ConnectWise PSA API Connection to expand the section.
- In ConnectWise Host (Domain Name), paste the URL of your ConnectWise server.
Note: The URL used for the API endpoint is usually the same as the PSA portal URL, but in some cases may differ, such as when using a different subdomain. If you experience errors during configuration, ensure you provide the URL of the API endpoint in this field. - In Company ID, paste the “My Company ID” value you use when logging in to ConnectWise.
- In Public Key, paste the value you copied in previous steps.
- In Private Key, paste the value you copied in previous steps.
- Click Test Connection to verify your credentials.
Note: After a successful connection, the “Test Connection” button will change to “Save.” - Click Save.
- Click Account Mapping to expand that section.
- Select a Catchall account, which will be the default if Blumira cannot match an account to a company in ConnectWise.
- Select one of the following mapping options:
- Auto-map Blumira “Account Name” to ConnectWise PSA “Company ID”
- Auto-map Blumira “Account Name” to ConnectWise PSA “Company Name”
- Manually Map
- If any companies appear as
Not mapped
in the table, select the appropriate company from the list, or you can leave them un-mapped which sets them to the catchall account.
Note: When you add new accounts in the future in the Accounts screen of the MSP Portal, you will have the option to map them to ConnectWise accounts by name. - Click Save Account Mapping.
- Click ConnectWise PSA Service Board to expand that section, then select the service board where findings will be sent.
- Click Save Board.
- Click Blumira-to-ConnectWise Ticket Flow to expand that section.
- In Failsafe Email, type one or more email addresses as backup recipients of finding alerts if new tickets cannot be created for any reason, such as a failed API connection.
Note: If the API connection fails, email notifications will be sent with a subject line that includes "Blumira integration failsafe used" at the end. - In Source Type, select the source you want to classify your Blumira tickets as coming from.
- Determine if you want to customize the finding statuses, priorities, and types to a preferred option in ConnectWise or if you want to keep Blumira's defaults for new tickets.
Important: If you customize these settings in Blumira and later change the values in ConnectWise without updating Blumira, it will cause the integration to fail and you will see new tickets using the failsafe address described in Step 19. Ensure that changes made in ConnectWise are also made in Blumira to keep the integration working as expected. - Click Configure ConnectWise PSA tickets from Blumira to expand the section, then set the default ticket Status, Type, and Priority by doing one of the following in each sub-section:
- To use Blumira's finding values in your tickets, select Do not set ticket [value] in ConnectWise PSA.
- To customize each value separately, complete these steps:
- Select Custom mapping.
- Click Configure and then choose how each value in Blumira should map into ConnectWise.
- Click Done.
- To default all findings to one value, complete these steps:
- Select Set a single [value] for all Blumira findings,
- In the dropdown menu, select the desired status, type, or priority.
- Click Save.
- Test the integration in the Verify and Enable/Disable section by doing the following:
- Next to Simulate from, select an account for the test ticket.
Note: If only one account appears, either you do not have sub-accounts or your license does not allow using the PSA integration on sub-accounts. - Click Send Sample Finding.
- (Optional) You can edit the priority and type options and send additional tests as needed to ensure other customization works as expected.
- Next to Simulate from, select an account for the test ticket.
- When you are ready to begin syncing findings to tickets, click Enable and then click Done.
Turning off finding notifications for service account users
The ticketing integration replaces the need to use a service account as a user in Blumira to send finding notifications to your ticketing tool. If you previously configured a ticketing user (such as a support or security inbox) in your accounts, we recommend disabling emails for findings in Notification Settings for that user to avoid duplicating tickets.
Note: Only finding notifications should be disabled. Sensor and cloud connector health alerts are not yet included in the ticketing integration, so they should remain enabled.
Removing the PSA integration
-
Navigate to MSP Portal > MSP Integrations.
-
In the integrations table, click ConnectWise.
-
In the MSP Integration Details window, click Remove.
If you keep encountering issues, we recommend revoking the API keys in ConnectWise by doing the following:
-
In ConnectWise, navigate to System > Members.
-
Click the API Keys tab.
-
Select the API key that was previously created for the Blumira API member.
-
Click Delete (trash icon).