Connect Blumira to Conduit

This walkthrough connects Blumira (SIEM and detection/response) to Conduit. Blumira’s public API authenticates with a JWT token — a long, three-part token string — rather than a classic API key. You obtain the JWT token from Blumira, then add it as an organization connection in Conduit.

Menu labels can change

The Blumira steps below reflect the flow at time of writing; menu labels can shift between releases. If a label differs, follow Blumira’s “Using the Blumira API” article.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Blumira login with access to the account’s API settings.

Step 1 — Obtain your Blumira JWT token

1. Sign in to your Blumira portal. Expected: the Blumira dashboard.
2. Obtain your API JWT token following Blumira’s API guide. Expected: a long token string (JWTs are three base64 segments separated by dots).
3. Copy the entire token — JWTs are long, and a truncated copy is the most common cause of a failed connection.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, revoke or regenerate it in Blumira first; the exposed token becomes useless immediately.

Step 2 — Connect Blumira in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Blumira in the catalog (under Security) and click Connect. Expected: a credential form with a single JWT Token field.
3. Paste the Blumira JWT token from Step 1 into the JWT Token field.
4. Click Connect. Expected: Conduit validates the token against Blumira’s public API immediately and shows a green Connected status. A bad token is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Blumira connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Blumira tool, such as listing recent findings. You should get real data back, and the call appears in your audit log with the correct user, vendor (blumira), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Blumira JWT token.”	The token is wrong, expired, revoked, or was copied incompletely — check that you pasted the entire JWT (all three dot-separated segments). Obtain a fresh token per Blumira’s guide and re-connect.
Connect fails with “Blumira returned HTTP <status>.”	Blumira answered with a non-auth error — usually a transient vendor-side issue. Wait and retry; if it persists, check Blumira’s status.
Tool calls return 403 “no credentials for vendor”	Blumira isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a token.
Tool calls worked, then start failing with auth errors	JWT tokens can expire or be revoked on the Blumira side. Obtain a fresh token and update the credential at /org/catalog.
Need to rotate the token	Obtain a new JWT token from Blumira, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.