Airlock Digital

Connect Airlock Digital to Radiant Security to forward execution telemetry and sensor information for AI triage.

Airlock Digital is an application allowlisting and execution control platform that prevents unauthorized binaries and scripts from running on endpoints. Connecting Airlock Digital forwards execution history and sensor information to Radiant Security through the Airlock REST API. Radiant uses this telemetry to investigate suspicious or blocked executions, attributing endpoint activity to specific users and hosts during AI triage.

Configuration is a one-time setup performed in the Airlock Digital console and Radiant Security. At the end of this configuration, you provide Radiant Security with the following values:

• Base URL
• API key

Prerequisites

• Admin access to Airlock Digital

Create a group and generate an API key in Airlock Digital

For vendor instructions, refer to the Airlock Digital REST API documentation.

In Airlock Digital, API keys are tied to a user account, and the user inherits API permissions from the groups they belong to. The steps below create a dedicated group for Radiant, add the required REST API roles, assign your user to the group, and generate the key. To reuse an existing group, add the same three roles to that group and skip ahead to generating the key.

1

Create the user group

In the Airlock Digital console, navigate to Settings and select the Users tab. Under User Group Management, click + Create.

In the Add User Group window, enter a descriptive name (e.g., Radiant API Access).

2

Assign the required REST API roles

Scroll to the Rest APIs Roles section and select the following roles:

• agent/find
• logging/exechistories
• logging/svractivities

Click the >> button to move the selected roles into the Current Roles list, then click Save.

3

Add your user to the group

Navigate to your user profile in the Airlock Digital console.

Select the group you just created and click the > button to move it into your Current User Groups list.

4

Generate the API key

Click Generate API Key. Copy the key to a secure location.

The API key is shown only once. If it is lost, you must generate a new one.

Add the data connector in Radiant Security

1. Sign in to Radiant Security.
2. From the navigation menu, select Settings > Data Connectors and click + Add Connector.
3. Search for and select Airlock Digital, then click Data Feeds.
4. Under Select your data feeds, select Airlock Digital Execution History and Airlock Digital Sensor Info, then click Credentials.
5. Under Credential Name, enter a descriptive name (e.g., Airlock-Credentials).
6. Under Required Credentials, enter the values you copied from Airlock Digital:

   • Base URL: your Airlock Digital console URL with the REST API port appended, in the format https://<your-instance>.managedwhitelisting.com:3129. Port 3129 is the Airlock REST API default; if your deployment uses a different port, substitute it here.
   • API Key: the API key you generated in the previous section.
7. Click Add Connector to save the configuration.

Verify ingestion

After Airlock Digital begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"airlock_digital_exec_history" and rs_connectorType:"airlock_digital_sensor_info".
3. Confirm recent events appear.

Allow several minutes for events to be parsed, indexed, and available for search.