> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting RocketCyber to Neo

> Copy your RocketCyber API token and save it in Neo

You connect RocketCyber once at the MSP level. The token reads every customer account under your provider account.

## 1. Copy the API token

**1. Open Provider Settings**

Sign in to the RocketCyber console as a provider administrator and open **Provider Settings**.

**2. Copy the Customer API token**

Copy the API token shown there. RocketCyber's [Customer API documentation](https://api-doc.rocketcyber.com/) links Kaseya's help on where to find it.

**3. Note your region**

RocketCyber hosts each provider in one region. The token works only in that region: **United States** (api-us.rocketcyber.com) or **Europe and UK** (api-eu.rocketcyber.com).

## 2. Add the token in Neo

**1. Open Integrations**

In the Neo Dashboard, open **Integrations** and find the RocketCyber card, under Endpoint Security.

**2. Save the region and token**

Pick your region, paste the API token and click **Save**. Neo checks the token against RocketCyber before saving, so a wrong token or region is rejected straight away.

## 3. Turn RocketCyber on per agent

Open the agent, go to the **Tools & Settings** tab, and configure the RocketCyber block under **Tools & Integrations**. The **Read Only** profile turns on every area. To leave an area out, set it to Disabled:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Incidents and Events** | Disabled, Read Only | Incidents with RocketCyber's remediation advice, the detection events behind them and the detection apps. Needed to work a RocketCyber ticket. |
| **Suppression Rules** | Disabled, Read Only | The suppression rules in place. Needed to advise a new rule. |
| **Accounts, Agents and Firewalls** | Disabled, Read Only | Customer accounts, devices and firewalls. |
| **Microsoft Defender and 365** | Disabled, Read Only | Defender health and risk per device, and Microsoft 365 secure score. |

Events and incidents name devices, users and IP addresses. To let the agent remediate what it finds, also give it your RMM's tools or Microsoft 365 permissions; those keep their own approval rules. See [RocketCyber API](https://docs.neoagent.io/agents/tools/security/rocketcyber-api.md) for what the agent can read.

## Set up an agent

Ask your Neo Support Agent for a triggered agent on your RocketCyber tickets, for example: "Set up an agent that analyses each new RocketCyber ticket, checks earlier tickets for the same detection, and writes the technician an internal note with the evidence, the next steps and any suppression rule to add."


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.