Secureworks Taegis Integration

Secureworks Taegis XDR (now part of Sophos) provides managed detection and response capabilities that can be integrated with CrownSync Playbooks via the REST API. When Taegis detects a threat or generates an alert, it can automatically create an incident in CrownSync, ensuring your response team can begin executing the relevant playbook immediately.

This integration uses the same REST API and API keys as other programmatic integrations. Taegis sends alert data to CrownSync, which creates an incident record and triggers any configured outbound webhooks.

Prerequisites

A CrownSync API key — generate one from Admin → Integrations (see the API Keys guide)
Administrator access to your Secureworks Taegis XDR console
A CrownSync Playbooks subscription on the Professional or Enterprise plan

Setup Steps

Generate a CrownSync API key. Navigate to Admin → Integrations → API Keysand create a new key. Copy the key immediately — it will not be shown again.
Configure Taegis. In the Taegis console, set up a custom integration or playbook action that sends an HTTP POST request to the CrownSync incidents endpoint: POST https://pb.crownsync.uk/api/v1/incidents
Map severity levels. Configure the integration to map Taegis severity values to the corresponding CrownSync severity levels (see the mapping table below).
Test the connection. Trigger a test alert in Taegis and verify that a new incident appears in CrownSync Playbooks. Check the audit log to confirm the event was received.

Example API Call

Below is an example curl command that mirrors what Taegis sends to CrownSync when an alert fires:

curl -X POST https://pb.crownsync.uk/api/v1/incidents \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Suspicious lateral movement detected",
    "severity": "high",
    "description": "Taegis detected lateral movement from 10.0.1.15 to 10.0.1.42 using SMB.",
    "source": "secureworks-taegis",
    "externalId": "TAEGIS-DET-2024-00491"
  }'

Severity Mapping

Map Taegis severity levels to CrownSync as follows:

Taegis Severity	CrownSync Severity
Critical	Critical
High	High
Medium	Medium
Low	Low
Informational	Low (or filter out)

Filter by Detection Category

Taegis categorises detections by type (malware, phishing, lateral movement, etc.). Consider filtering which categories trigger CrownSync incidents to avoid alert fatigue. For example, you might only escalate detections categorised as "Confirmed Threat" or "High Confidence" while logging informational detections separately.

Secureworks acquisition

Secureworks was acquired by Sophos in 2025. The Taegis XDR platform continues to operate under the Secureworks brand. API endpoints and documentation may transition to Sophos domains in the future.

Next Steps

Review the full REST API Reference for all available endpoints and request fields
Configure outbound webhooks to notify your team when Taegis-created incidents are updated
Set up severity-based routing to assign the correct playbook automatically

Integration instructions last verified: April 2026