Blackpoint Cyber

Overview

The Blackpoint Cyber integration lets Bumblebee read from the CompassOne platform — Blackpoint's managed detection and response (MDR) console. It is built for client reporting: assembling a quarterly business review of what Blackpoint caught for a client, how their security posture moved, and what vulnerabilities remain open.

The integration is read-only. It never creates, modifies, or deletes anything in CompassOne.

Prerequisites & Setup

Before setting up the Blackpoint Cyber integration, you need:

• A Blackpoint CompassOne account with administrator access
• A CompassOne API token

Generate an API token

1. Sign in to your Blackpoint CompassOne console
2. Open your account or organization settings and find the API / API tokens section
3. Create a new token — read-only scope is sufficient for Bumblebee
4. Copy the token immediately and store it securely

Important: API tokens are typically shown only once at creation. If you navigate away without copying the token, you will need to generate a new one.

If you cannot find API settings, API access may not be enabled for your plan. Contact your Blackpoint account team or support@blackpointcyber.com and ask them to enable CompassOne public API access.

Configure in Bumblebee

1. Go to Integrations
2. Select Blackpoint Cyber
3. Paste your API Token
4. Save the configuration
5. Run a test request (e.g. list tenants) from the validation card

How tenants work

CompassOne scopes its data by tenant — one tenant per client organization you manage. Your token is not tied to a single client: Bumblebee asks CompassOne which tenants the token can reach, then reports on whichever client you name. One connection therefore covers your whole client book.

If a client is missing from Bumblebee's answers, the token most likely lacks access to that tenant.

Available Tools

All tools are read-only.

Finding a client

• list_tenants — List the client organizations the token can see. Call this first to resolve a client name to the tenant_id the other tools need.
• get_tenant — One client's profile: name, domain, industry, and which Blackpoint services are enabled.

Blackpoint's own reports

• list_reports — List the periodic reports CompassOne generates for a client (Executive, MDR, or Cloud), filtered by date range.
• get_report_json — Read one report's contents as structured data.
• get_report_url — Get a signed download link for one report's PDF, to attach to a deck.

Security posture

• get_security_posture_rating — The client's current posture score.
• get_security_posture_rating_history — How the score has moved, over 1, 6, or 12 months.
• get_security_posture_rating_categories — Score broken down by operational category and by NIST category.

Detections

• get_alert_group_count — How many detections Blackpoint handled in a date range, optionally split by open vs resolved.
• get_alert_groups_by_week — Detection counts bucketed by week, for a trend chart.
• get_top_detections_by_threat — The most common threat types seen, ranked by volume.

Vulnerabilities

• get_vulnerability_count_by_severity — Current vulnerability counts by severity.
• list_vulnerabilities — The vulnerabilities themselves, filterable by severity, status, discovery date, whether they are prioritized, and whether they are known to be actively exploited.

Example questions

• "Which clients do we have in Blackpoint?"
• "Pull the Executive reports for Acme Corp for last quarter."
• "How many threats did Blackpoint handle for Acme last quarter, and how many are still open?"
• "What were the top threat types for Acme over the last 90 days?"
• "How has Acme's security posture score moved over the last six months?"
• "Show me Acme's posture broken down by NIST category."
• "What critical vulnerabilities are open for Acme right now?"
• "Which of Acme's vulnerabilities are being actively exploited?"

What the data can and cannot tell you

Three CompassOne limits affect what a quarterly review can claim. Bumblebee's agent knows about all three and will tell you when one applies, but they are worth knowing when you plan a report.

Detections are retained for 90 days

CompassOne keeps detection data for a rolling 90-day window. A calendar quarter is 90–92 days, so if you assemble a review a week after quarter close, the first days of that quarter are already outside the window.

For periods older than 90 days, use the report tools instead (list_reports + get_report_json). Blackpoint's periodic reports capture the numbers at the time they were generated and are not subject to the limit.

Vulnerability counts are current, not historical

The vulnerability statistics always describe right now. They cannot tell you how many critical vulnerabilities were open at the start of a quarter, so they cannot on their own produce a quarter-over-quarter comparison or a remediation burn-down chart.

Filtering by discovery date does not work around this: a vulnerability found last year and still open today reports today's status. For historical vulnerability state, use the periodic reports.

Posture history has no three-month option

Posture history is available over 1, 6, or 12 months — there is no three-month range. For a quarterly trend, Bumblebee requests six months and narrows the result to your quarter.

Notes

• Read-only. The integration exposes none of the CompassOne API's write operations.
• Reporting cadence. Blackpoint generates its periodic reports monthly, so a quarter is normally three report runs, which Bumblebee stitches together.
• Scoping. The token's tenant visibility determines which clients Bumblebee can report on.