Security & Backup

RocketCyber

Read your RocketCyber MDR posture from Dex - incidents, agents, detections, firewalls, and Microsoft 365 and Defender health per customer.

Dex connects to RocketCyber MDR through the Customer API v3 so admins can review security posture conversationally - list open incidents, triage agents by connectivity, pull event summaries and malicious detections, and check firewall, Microsoft 365, and Microsoft Defender health. Read-only for this first ship: Dex browses customer-scoped collections but does not write back. Deployed as an MSP global app - one shared Provider API Bearer token covers every customer account, and each Dex tenant is confined to its RocketCyber account_id so a customer only ever sees its own data.

Start free →

What Dex does with RocketCyber

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

List open and resolved incidents for a customer, with title, created date, and remediation
Triage agents by connectivity - online, offline, or isolated - with hostname, OS, and version
Pull an events summary across apps and verdicts, then drill into malicious or suspicious detections by app
Review firewall inventory, Microsoft 365 posture, and Microsoft Defender health per device
List active suppression rules for a customer account
List the customer account roster from the MSP master connection
Deploy as an MSP global app - one shared Provider API Bearer token, each tenant confined to its RocketCyber account_id

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Show me the open incidents for this customer, newest first
>Which agents are offline or isolated right now?
>Give me the events summary, then pull the malicious detections from the last 7 days
>What does Microsoft Defender health look like across this account?
>List the active suppression rules for this customer

Policy actions

Every action Dex can take on RocketCyber is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`rocketcyber_list_accounts`	List RocketCyber customer accounts (MSP master); on a scoped child returns this account details with forced accountId	—
`rocketcyber_list_agents`	List agents for this RocketCyber account (query-forced)	self-only
`rocketcyber_list_apps`	List apps for this RocketCyber account (query-forced)	self-only
`rocketcyber_list_defender`	List Microsoft Defender health and risk for this RocketCyber account (query-forced)	self-only
`rocketcyber_list_events`	List events for this RocketCyber account (query-forced)	self-only
`rocketcyber_get_events_summary`	Get the events summary for this RocketCyber account (query-forced)	self-only
`rocketcyber_list_firewalls`	List firewalls for this RocketCyber account (query-forced)	self-only
`rocketcyber_list_incidents`	List incidents for this RocketCyber account (query-forced)	self-only
`rocketcyber_list_office`	List Microsoft 365 posture for this RocketCyber account (query-forced)	self-only
`rocketcyber_list_suppression_rules`	List suppression rules for this RocketCyber account (query-forced)	self-only

How to configure RocketCyber

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In RocketCyber, go to Provider Settings > API and create a Provider API token for Dex.
2
Note your region - US (api-us.rocketcyber.com) or EU (api-eu.rocketcyber.com).
3
On the MSP master connection, leave account_id blank and run GET /v3/account to look up each customer account id.
4
In Dex, enable the RocketCyber integration and paste the API token and region.
5
For each managed customer, set its RocketCyber account_id on that tenant's connection - Dex forces accountId on every scoped read so the customer only sees its own data.

Credentials required

api_token: RocketCyber Provider API Bearer token (secret; never surfaced back)
account_id: This tenant's RocketCyber customer account id (positive integer); leave blank on the MSP master connection
region: RocketCyber region - us or eu (default us)

Requirements

•A RocketCyber Provider API Bearer token from Provider Settings > API on the MSP master
•Each Dex tenant mapped to one RocketCyber account_id; blank account_id means the MSP master connection
•Read-only for this first ship - Dex browses accounts and customer-scoped collections but does not write back
•For MSPs, deploy as a global app with per-tenant account_id scoping