> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting TridentStack to Neo

> Create a TridentStack Control API key and save it in Neo

You connect TridentStack once at the MSP level. One API key covers every Organization the person who creates it can see.

## Before you start

Neo keeps each ticket inside its customer's Organization, so turn on **Organizations** (TridentStack's MSP mode) in **Settings > Organizations**, with one Organization per customer. Without it, Neo can still answer from a chat or a scheduled agent, but it sends no TridentStack call on a customer's ticket.

## 1. Create the API key

**1. Sign in as an administrator**

Sign in to TridentStack Control as an administrator who can see every Organization Neo should reach. The key reaches the same Organizations as the person who creates it.

**2. Generate the key**

Open **Settings > API Keys** and choose **Generate Key**. Name it `Neo`, and click **Create**.

**3. Copy the key**

Copy the whole key. It looks like `keyId.secretKey` and shows only once. Store it only in Neo.

> [!NOTE]
>
> A standard key reads everything, installs updates and restarts one endpoint at a time, and runs scans. Installing updates or restarting in bulk, removing endpoints and deploying policy objects need a **privileged** key, which you set when you create or edit the key. Give Neo a privileged key only when your agents should do those.

> [!WARNING]
>
> Revoking the key cuts Neo off at once. If the person who created the key is removed from TridentStack, the key stops working inside your Organizations: create a new key under an active administrator and save it here.

TridentStack limits each key's requests per period, with separate allowances for reads and changes, shared by all of your account's keys. Neo uses at most 30 a minute.

## 2. Add the key in Neo

**1. Open Integrations**

In the Neo Dashboard, open **Integrations** and find the TridentStack card, under Vulnerability & Attack Surface.

**2. Save the key**

Paste the API key and click **Save settings**. Neo checks it against TridentStack before saving, so a wrong key is rejected straight away.

Neo then maps your TridentStack Organizations to your PSA companies. Check the **Organization Mapping** tab on the card, and confirm or correct each suggested match.

## 3. Turn TridentStack on per agent

Open the agent, go to its **Tools & Settings** tab, click **Vulnerability & Attack Surface**, and expand the **TridentStack** block. Pick one of its **Presets**, or set each area yourself:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Organizations** | Disabled, Read Only | The Organizations the key reaches. |
| **Endpoints** | Disabled, Read Only, Read / Write | Details, health, history, update checks, software, open ports and logs; reboot settings. Removing an endpoint always asks. |
| **Installs & Restarts** | Disabled, Read Only, Read / Write | Installing updates and feature upgrades, pre-staging, restarting, pushing policies. Changes only: Read Only allows none. |
| **Scans & Log Collection** | Disabled, Read Only, Read / Write | Vulnerability scans, compliance evaluations, network refreshes and log collections. Changes only: Read Only allows none. |
| **Update Policies & Rings** | Disabled, Read Only, Read / Write | The update catalog, update policies and approvals, deployment rings and executions. |
| **Application Updates** | Disabled, Read Only, Read / Write | Application update configurations and their applications. |
| **Configuration Policies** | Disabled, Read Only, Read / Write | Policy objects, assignments, security and service settings. |
| **Vulnerabilities** | Disabled, Read Only, Read / Write | Findings and CVEs, a finding's status, and vulnerability exceptions. |
| **Compliance** | Disabled, Read Only, Read / Write | Frameworks, scores, controls, exemptions and Endpoint Checks. |
| **Tags & Automation** | Disabled, Read Only, Read / Write | Agent tags and tag automation rules. |
| **Reports & Dashboards** | Disabled, Read Only, Read / Write | Reports, dashboards and metrics. |
| **Settings, Licensing & Enrollment** | Disabled, Read Only, Read / Write | Account settings, licences and enrollment tokens. |

| Preset | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read, and scans | Installs, restarts and endpoint changes; no policy or other write is allowed |
| **IT Admin** | Every read and almost every write | Vulnerability exceptions and status changes, compliance exemptions, account settings, replacing a settings, application or policy record whole, and removing an endpoint |
| **Full Automation** | Every read and write | Removing an endpoint, and replacing a settings, enrollment token, application or policy record whole |

See [TridentStack API](https://docs.neoagent.io/agents/tools/security/tridentstack-api.md) for what the agent can read and change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.