Adlumin

Overview

The Adlumin integration lets Bumblebee read from Adlumin, N-able's managed detection and response platform (also sold as N-able MDR). It is built for security reporting: summarising a client's security posture, reporting what was detected in a period, and checking EDR agent coverage.

The integration is read-only. It never acknowledges a detection or changes anything in Adlumin.

Research preview. This integration has not been confirmed against a live Adlumin tenant. If a tool returns unexpected data, please let us know.

Note: Adlumin is a separate product from N-Central, with its own API and its own credentials. Connecting N-Central does not give Bumblebee access to Adlumin data.

Prerequisites & Setup

Before setting up the Adlumin integration, you need:

• An Adlumin API key
• The tenant ID of each client you want to report on

Request an API key

Adlumin does not expose API-key generation in the customer portal. N-able's documentation says to obtain the key from your Adlumin platform administrator.

1. Contact your Adlumin platform administrator, or your N-able account team if you do not have one
2. Ask for an Adlumin API key for the Adlumin XDR/MDR API, for read-only reporting
3. Store the key securely when you receive it

Worth asking up front: if you manage several client tenants, ask whether one key covers all of them or whether each tenant needs its own. N-able does not document this, and it determines whether a single Bumblebee connection can report on your whole client book.

Collect your tenant IDs

Each client is a tenant in Adlumin, identified by a value that looks like tnt_4f81ac. The Adlumin API has no endpoint that lists tenants, so Bumblebee cannot discover them — you supply the ones you want to report on.

1. Sign in to the Adlumin platform
2. Find the tenant ID for each client you want to report on
3. If you cannot locate them, your Adlumin administrator or N-able account team can provide the list

Configure in Bumblebee

1. Go to Integrations
2. Select Adlumin
3. Enter:
   • API Key — the key you were issued
   • Tenant IDs — comma-separated, for example tnt_4f81ac, tnt_9c02de
4. Save the configuration
5. Run a test request from the validation card

How tenants work

Every Adlumin call is scoped to one tenant. Because the API cannot list them, Bumblebee works from the tenant IDs you stored with the credential:

• One tenant configured — Bumblebee uses it automatically; you never have to name it.
• Several configured — name the client in your question. If Bumblebee cannot tell which tenant you mean, it will say so and list the ones it can reach, rather than guessing and reporting on the wrong client.

Available Tools

All tools are read-only.

Finding a client

• list_tenant_ids — List the tenant IDs configured for this connection. Answers "which clients can Bumblebee see?" without calling the API.

Security posture

• get_complete_endpoint_data — One tenant's aggregated posture summary, and the best starting point for a security report. Covers at-risk systems, shares and groups; stale sensor counts; Active Directory compliance counters such as stale accounts, non-expiring passwords and GPO violations; the network health score; and which Adlumin services are enabled.

Detections

• list_detections — The MDR detection feed for a tenant. Filter by severity (Critical, High, Medium, Low, Informational), by acknowledgement, by MDR workflow status (Incident Declared, Request Customer Review, In Progress, Received By MDR, Escalated, Rejected), and by date range. Each detection carries its type, event time, source and destination host, the account involved, and any linked ticket.

Endpoint agents

• list_endpoint_data — The EDR sensor inventory for a tenant: which hosts run which agent (SentinelOne, Carbon Black, CrowdStrike, or Defender), at what version, under which policy, and when each was last seen. Filter to connected or disconnected agents for coverage reporting.

What you can ask

Once connected, you can ask Bumblebee questions like:

• "Summarise Contoso's security posture for last quarter"
• "What critical detections came in this month, and were they all acknowledged?"
• "Which endpoints haven't checked in recently?"
• "How many hosts are running an EDR agent, and how many aren't?"
• "Show me the detections that were escalated, with the hosts involved"
• "What's our network health score, and what's dragging it down?"

Limitations

The Adlumin API is narrower than the Adlumin console. These are not available through it, so Bumblebee cannot report on them:

• Research preview. This integration is read-only and its response shapes are not yet confirmed against a live Adlumin tenant. Tell us if a tool returns something unexpected.
• Vulnerability data — no vulnerability scan results
• Compliance-framework reports — PCI DSS, NIST, HIPAA, CMMC and similar reports exist in the product but not in the API
• Cases — detections carry a workflow status and a linked ticket, but cases are not first-class API objects
• SIEM log volume — no ingestion or log-volume metrics
• Identity data — no ITDR or Microsoft 365 identity listings
• Generated PDFs — Adlumin's executive and compliance reports cannot be downloaded through the API

Bumblebee builds its reports from the posture summary, detections, and sensor inventory instead.

Troubleshooting

An authentication error on every call — the key was rejected. Confirm it is current and issued for the Adlumin XDR/MDR API.

A tenant returns nothing — either that tenant ID is wrong, or your key does not cover it. Ask your Adlumin administrator whether the key spans all of your tenants.

Bumblebee asks which tenant you mean — several tenant IDs are configured and the question did not identify a client. Name the client, or use the tenant ID directly.