Skip to main content
Blackpoint Cyber’s CompassOne is managed detection and response: a 24/7 SOC watches your customers’ endpoints (MDR) and their Microsoft 365, Google Workspace and Cisco Duo (Cloud Response), and opens a ticket in your PSA for each detection. Connect it once with an API key from your Blackpoint partner account, and Neo agents can read and act across your Blackpoint customers.

​
What Neo can do with Blackpoint

  • Read the detection behind a Blackpoint ticket in your PSA ([Blackpoint][<customer>][<user>][Cloud Response (M365)][<detection>]): the alerts, IP, country, device and the SOC’s status, then record what it found and resolve the PSA ticket as your instructions allow
  • Add a user’s travel window in Cloud Response when a person your agent’s instructions allow to approve travel asks to let them sign in from abroad, read it back, and note it on the ticket. A request from the travelling user alone, or for a country for every user, goes to your technician
  • Check a “Login from Unapproved Country” alert against the travel requests on file, and escalate any sign-in no request covers
  • Read each customer’s assets, vulnerabilities, dark web and external exposures, posture rating and reports, for a QBR or a security review
  • Find devices whose Blackpoint agent stopped reporting
  • Read and change the escalation contact groups Blackpoint’s SOC calls, and complete or re-sync Cisco Duo onboardings
Blackpoint’s API has no write on a detection: the SOC closes its own ticket in Blackpoint, and Neo works the ticket in your PSA. Allowing an application that Managed Application Control blocked happens in the Blackpoint portal; Neo hands your technician the device, the application and its path.

​
Each ticket stays with its customer

One Blackpoint key reaches every customer tenant of your partner account. On a ticket that names a company, Neo sends a call only for the Blackpoint tenant that company is mapped to, and refuses the calls that reach every customer (the tenant list, contact groups). Those run from a chat with Neo or a scheduled agent.

​
Approved countries ask first, by default

An approved country, or a user’s travel window, lets sign-ins from that country through. The Helpdesk and IT Admin presets ask a technician before Neo adds or removes one; only Full Automation adds it on its own. Removing a Cisco Duo onboarding always asks, whatever the agent’s settings, because Cloud Response stops watching that account.

​
Secrets stay out of the run

Neo hides each breached password in a dark web exposure and each tenant’s SNAP agent install link before the agent or a script reads the answer. Neo never takes your Duo secret key, so a Cisco Duo onboarding starts in the CompassOne portal; agents can complete and re-sync it after that.

​
Your customers are mapped to companies

Neo matches your Blackpoint tenants to the companies in your PSA and keeps the mapping on the Blackpoint card’s Organization Mapping tab, refreshed on each PSA metadata sync. Matching uses the tenant name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Next comes the tenant’s domain against the company’s website, and last an AI match for the long tail. Blackpoint names the tenant in each ticket title, so keeping the Blackpoint and PSA names the same also routes those tickets to the right company. A name that matches exactly one of your PSA companies, as it is or after stripping a legal-form suffix, or a match you confirm, is handed straight to your agents. A domain match and an AI match wait for you on the Organization Mapping tab. A name two of your PSA companies share, or two tenants that match one company, is left unmapped until you set it. Confirm or correct each there; a mapping you set by hand survives every later sync. See Blackpoint API for the permission groups.

​
Next steps

Connect Blackpoint

Create an API key and save it in Neo.