> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# RocketCyber API

> Read RocketCyber SOC incidents, their detection events, devices and suppression rules, so an agent can analyse a RocketCyber ticket and advise the technician

The common use is a triggered agent on RocketCyber tickets: the agent reads the incident named in the ticket title, its detection events and the device, finds how earlier tickets for the same detection were resolved, and writes the technician an internal note with the evidence, RocketCyber's remediation advice, the next steps and any suppression rule to add.

> [!NOTE]
>
> Automatically enabled when you configure RocketCyber permissions in your agent workflow.

## What It Does

* Read incidents, with RocketCyber's remediation advice, by id, status, title or date
* Read the detection events behind an incident, and event summaries per detection app
* Read agents (devices) with their connectivity, OS and last connection, and firewalls
* Read suppression rules, active or expired
* Read Microsoft Defender health and risk per device, and Microsoft 365 secure score per customer

Neo reads RocketCyber and changes nothing there. To act on what it finds, the agent uses the RMM or Microsoft 365 tools you give it, under their own approval rules, and tells the technician what to change in the RocketCyber console.

## Permission Groups

| Group | Access levels | Covers |
| - | - | - |
| Incidents and Events | Disabled, Read Only | Incidents with remediation advice, detection events (devices, users, IP addresses), event summaries and detection apps |
| Suppression Rules | Disabled, Read Only | Suppression rules: names, conditions, status and expiry |
| Accounts, Agents and Firewalls | Disabled, Read Only | Provider and customer accounts, agents (hostname, IP and MAC address, OS, connectivity) and firewalls |
| Microsoft Defender and 365 | Disabled, Read Only | Defender health and risk per device, Microsoft 365 secure score and sign-in posture |

Every group is read only.

## Setup

See [Connecting RocketCyber to Neo](https://docs.neoagent.io/integrations/rocketcyber/connecting-to-neo.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.