Skip to main content
The common use is a Blackpoint ticket in your PSA: the agent reads the detection behind it, checks the facts, adds a user’s travel window when a customer asked for one, and resolves the PSA ticket as your instructions allow. Agents also read each customer’s assets, vulnerabilities, exposures and posture for a QBR.
Automatically enabled when you configure Blackpoint permissions in your agent workflow.

​
What It Does

  • Read a customer’s detections (alert groups) with their alerts, hosts, users, IPs and the SOC’s status, and detection counts and trends
  • Read assets, vulnerabilities, scans, dark web and external exposures, the posture rating and reports
  • Read Microsoft 365 connections and users, approved countries and travel windows, and add or remove one
  • Read Google Workspace and Cisco Duo onboardings; complete, re-sync or remove a Duo one. Neo does not start a Duo onboarding, because its request carries your Duo secret key: start it in the CompassOne portal
  • Read and change escalation contact groups, their members and the tenants each covers
Blackpoint’s API has no write on a detection. The SOC closes its own ticket in Blackpoint; the agent works the PSA ticket. Allowing a blocked application happens in the Blackpoint portal.

​
Permission Groups

​
Access Profiles

​
Safety Controls