Before you start
- Neo uses the Airlock Digital REST API, which the Airlock server serves at
https://<server>:3129/v1/unless you changed its port. This holds whether you host the server or Airlock hosts it for the client. - Neo reaches the server over the internet. The REST API must answer on HTTPS with a certificate from a public certificate authority, at a public address.
- If Airlock’s REST IP allowlist is on, add Neo’s addresses to it.
- Neo connects to each client’s server on its own. Add the client to your Companies tab first.
If the Airlock server is only on the client’s internal network
Publish only the REST API, never the Airlock console, through a reverse proxy at the client’s network edge that:- answers on a public name over HTTPS, with a certificate from a public certificate authority;
- forwards only paths under
/v1/to the Airlock server’s REST port, and refuses every other path; - accepts connections only from Neo’s addresses;
- passes the
X-ApiKeyheader through.
https://airlock-api.example.com:443).
1. Make an Airlock user and API key for Neo
1
Make a user group with REST permissions
In the Airlock console, make a user group for Neo and give it the REST permissions your agents need: for example
agent/find, group, group/agents, group/policies, getexechistory, otp/usage and otp/activities for an agent that only reads; add agent/move, otp/retrieve, otp/revoke, hash/query, hash/application/add, exception/list and exception/approve for the move, OTP and allowlisting jobs. Neo checks the key with group, so include it.2
Make the user
Make a local Airlock user for Neo in that group, such as
neo-api.3
Copy its API key
Sign in as that user, or as an administrator, and copy the user’s API key from its settings.
2. Add the connection in Neo
1
Open Integrations
In the Neo Dashboard, open Integrations → Airlock Digital, under Endpoint Security.
2
Pick the client
In Customer, choose the client this server belongs to. The client must be on your Companies tab. For a second client, click Add customer.
3
Save the address and the key
Enter the Server URL with its port (for example
https://airlock.example.com:3129, or the proxy’s address) and the API Key, then click Save settings. Neo lists the policy groups before saving, so a wrong address or a refused key is rejected straight away, with what to fix. A URL with no port is saved with 3129.3. Turn Airlock Digital on per agent
Open the agent, go to the Integrations section, and configure the Airlock Digital block. Agents see only what Neo’s API key can see.Pick an access profile
Read Only
Read agents, policy groups, blocked files, OTP history and exception requests. Nothing is changed.
Helpdesk
Moving computers, OTP codes, exception requests and allowlisting a file wait on a technician. Everything else is read only.
IT Admin
Moving computers, blocklisting, revoking OTP codes and deciding exception requests run without approval, except the changes that always ask. Allowlisting, exclusions, policy settings and users wait on a technician.
Full Automation
Every change runs without approval, except the changes that always ask a technician.
Or set each area by hand
Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting.
Changes that always ask a technician
These wait on a technician under every profile, whatever the area’s own approval setting:- Issuing an OTP code.
- Audit mode, script control mode and the agent stop code, which stop blocking or let a user stop the agent.
- Removing an agent, and moving a computer to Unmanaged.
- Deleting a policy group, an allowlist, a baseline, a blocklist or an allowlist category, and replacing a group’s configuration with another group’s.
- Removing a hash from every allowlist, every baseline or every blocklist at once.
- The proxy settings, which store the proxy password.
- Setting the licence key, and any change to console users.
- Any change that stores a credential: a password, a stop code or a licence key.