Field Effect

Overview

Field Effect is a managed detection and response (MDR) vendor. Its Covalence platform monitors endpoints, networks, cloud tenants, and email, and surfaces everything through the MDR Portal. The central alert entity is the ARO — Action, Recommendation, or Observation — released by Field Effect analysts with a type, severity, status, and resolution.

The Bumblebee integration is read-only and focused on security reporting: ARO activity and trend reports, risk posture across endpoints / accounts / cloud tenants, vulnerability exports, endpoint inventory with antivirus posture, network and DNS firewall telemetry summaries, and the reports Field Effect itself generates.

The tools follow Field Effect's official APIs overview, which describes the Portal API as a RESTful JSON API authenticated with an API key and calls out exactly these use cases — exporting endpoint data with risk levels, ARO reporting by type or state, and exporting vulnerability information for all endpoints in an organization.

Prerequisites & Setup

Before setting up the Field Effect integration, you need:

• A Field Effect MDR Portal account with access to the organization(s) you want to report on
• An API key created in the portal

Create an API Key

1. Sign in to your Field Effect MDR Portal
2. In the bottom of the left sidebar, select Account Settings
3. Open the Sign in & Security tab
4. Scroll to the API Keys section and click Create API Key
5. Copy the key immediately — it is shown exactly once

The key grants the same access as the email and password you sign in with, so store it securely.

Vendor documentation:

• Field Effect APIs: Overview — authentication and common use cases
• The same Help Center section (Connect → API) covers Create an API Key and Obtaining your Organization ID
• Interactive Swagger documentation lives in the MDR Portal under Support → API Documentation

Configure in Bumblebee

1. Go to the Integrations page in Bumblebee
2. Select Field Effect
3. Paste your API Key and set the API Base URL (https://services.fieldeffect.net/v1 for standard accounts; a demo tenant uses https://services.demo.fieldeffect.net/v1)
4. Save the configuration
5. Run a test request (e.g. list organizations) from the validation card

Available Tools

Reporting (11 tools)

• list_my_organizations — Organizations the API key is a direct member of, with license type and status. Call first to discover organization ids. For MSP partner keys this is only the provider's home tenant — the response points at list_partner_organizations for the client roster.
• list_partner_organizations — The MSP partner book of business: the provider-managed client organizations that the vendor's own organization listing never returns (discovered automatically via the provider hierarchy, with endpoint device counts when derived from provider-scoped data). Each entry carries its provider_id.
• list_aros — AROs (alerts/findings) with filters for type, severity, status, resolution, sensor, text_search, assignees, release/last-update time windows, and organization. Pass an ARO id with the full-payload option to read its details and remediation steps.
• get_aro_statistics — Server-side ARO aggregates; one tool for two statistics: total_aros (grouped counts) and resolution_duration (min/average/max time-to-resolution). Group by type, status, severity, resolution, template_id, or organization_id.
• list_risks — Unified risk feed across Endpoint, Account, and Cloud Tenant entities: risk type (e.g. "End of Life OS", "No MFA", "Credential Exposure"), category, level, 0–10 score, and evidence data.
• list_vulnerabilities — CVEs detected on monitored endpoints with CVSS score/vector and EPSS exploit-probability scores.
• list_endpoint_devices — Endpoint inventory: hostname, online state, OS, agent version, antivirus type/status/compliance, per-device risk level, last-seen user and time.
• list_security_summaries — One tool for three telemetry feeds: covalence (daily network summaries — alerts, blocklist hits, DNS resolutions, bytes in/out), covalence_aggregated (the same telemetry pre-rolled server-side into 24-hour / 7-day / 4-week periods), and dns_firewall (hourly/daily DNS request, security-block, and content-block series).
• get_ai_usage — Shadow-AI reporting across six views: summary (product/user/device totals), categories, products (e.g. GitHub Copilot, Notion AI — with vendor and user/device counts), users, devices, and signals (the raw domain/process/software sightings behind the rollups).
• get_security_statistics — Pre-aggregated rollups in one tool: risk_score_overview (component risk scores), threat_locations (geo threat map), top_source_countries / top_source_asns, most_threatened_emails, dns_activity_counts, aggregated_dns_blocks (grouped by category/domain/user/...), dns_block_categories, and endpoint_device_counts (online/offline or per-OS).
• list_reports — Reports Field Effect has generated (weekly, monthly, executive, Covalence MDR with risk-score / vulnerability / dark-web subtypes) and their downloadable artifacts.

Example: monthly security report

Ask the assistant something like "Summarize our Field Effect security posture for the last 30 days." The agent composes:

1. list_my_organizations() — resolve the organization
2. get_aro_statistics(group_by=["severity"]) and get_aro_statistics(group_by=["type"]) — ARO volume breakdowns
3. list_aros(severity=["High","Critical"], released_time_since=...) — notable findings
4. list_risks(risk_level=["Critical"]) and list_vulnerabilities(sort_by="cvss_score") — top risks and CVEs
5. get_security_statistics(statistic="risk_score_overview") and get_security_statistics(statistic="dns_activity_counts", ...) — risk score breakdown and DNS protection totals
6. get_ai_usage(view="summary", since=...) — AI tool adoption across the fleet

API Notes & Limits

• Authentication is a raw API key sent as Authorization: Bearer <key>; there is no token exchange.
• Datetime filters use the strict UTC format YYYY-MM-DD HH:MM:SS; ISO 8601 forms with T or Z are rejected.
• The ARO list rejects filtering on created time — the tools use release / last-update time windows instead.
• MSP partner (provider) accounts: Field Effect's organization listing only returns organizations the key is a direct member of — never a provider's managed clients. The integration walks the provider hierarchy for you: managed client organizations appear in list_partner_organizations, and the provider id is applied automatically to data queries that target them (or that are unscoped), so reports span the whole client base without any manual scoping. Clients with no endpoint devices and no AROs can be missed when the key lacks the provider roster permission — the tool notes this in its response.
• Provider-level rollups (client summaries across all managed client organizations) require a partner-scoped key; an organization-level key gets a permission error on those endpoints and they are not part of this integration.
• Write operations (ARO transitions, comments, assignments) and binary report/PDF downloads are not included in this round.