Lacework

The Lacework connector pulls alerts (formerly "events") from a Lacework tenant into AiSOC. One connector instance covers every Lacework surface — workload, container, cloud configuration, and identity — because the Lacework v2 /Alerts API is unified across all of them.

What you get

Source	Lacework v2 endpoint	Notes
Alerts	GET /api/v2/Alerts	All severities, last poll window

Events are normalized with source: lacework and the original Lacework alert envelope is preserved on raw_event so playbooks can target specific alert categories (e.g. Compliance, CloudActivity).

Prerequisites

• A Lacework tenant with an account subdomain (e.g. yourcorp for https://yourcorp.lacework.net).
• A Lacework API access key:
  • keyId — the access-key ID
  • secret — the access-key secret
• (Optional) A subaccount name if your tenant runs the multi-account model and you want to scope ingestion to a single subaccount.

API keys are created in the Lacework console under Settings → API Keys → Create New. Copy the key and secret immediately — Lacework only shows the secret once.

Setup walkthrough

1. Create the API key

1. In the Lacework console, Settings → API Keys → Create New.
2. Name the key aisoc-prod (or similar) and submit.
3. Save the Key ID and Secret to a password manager.

2. Add the connector in AiSOC

1. Connectors → Add connector → Lacework.
2. Account subdomain — first label of your console URL (e.g. yourcorp for https://yourcorp.lacework.net).
3. Subaccount (optional) — leave blank unless you want to scope the poll to a Lacework subaccount.
4. Access Key ID and Secret Key — paste from step 1.
5. Test connection — AiSOC exchanges the key/secret for a 1-hour bearer token via POST /api/v2/access/tokens and confirms a 200 on a 1-row /Alerts query.
6. Save.

Polling details

• Default interval: 300 seconds.
• Each poll re-authenticates against POST /api/v2/access/tokens if the cached bearer is expired (Lacework tokens are valid for ~1 hour).
• The poll requests the last interval × 2 seconds of alerts (default 10 minutes) using startTime / endTime query parameters in the /Alerts endpoint.

Severity mapping

Lacework alerts use a numeric severity (1 = critical, 5 = info). AiSOC maps these into the canonical five-tier ladder without downgrading critical findings:

Lacework severity	AiSOC severity
1 — Critical	critical
2 — High	high
3 — Medium	medium
4 — Low	low
5 — Info	info

The original numeric severity is preserved under raw_event.severity.

Subaccount scoping

If you operate multiple Lacework subaccounts (typical for MSSPs and multi-business-unit deployments), create one AiSOC connector instance per subaccount rather than rotating the same instance. This keeps per-tenant audit logs clean and lets you set different polling cadences per subaccount.

When the Subaccount field is set, the connector adds the Account-Name header to every API call and the bearer token is scoped to that subaccount.

Live actions

The Lacework connector is read-only as of v7.3.1. Containment for cloud findings flows through the AWS Security Hub, Cloudflare, or GCP Cloud Audit connectors.

Troubleshooting

could not authenticate to lacework — the keyId / secret pair is wrong, or the account subdomain has a typo. Test the credentials directly:

curl -X POST "https://YOUR_ACCOUNT.lacework.net/api/v2/access/tokens" \
  -H "X-LW-UAKS: YOUR_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"keyId":"YOUR_KEY_ID","expiryTime":3600}'

A 200 response with { "token": "..." } confirms the credentials are good — the issue is then in the AiSOC field values.

HTTP 403 on /Alerts — the API key was created on the parent account but you set a Subaccount value the key cannot reach. Either clear the Subaccount field or generate a key from the subaccount itself.

events_added: 0 between polls — the tenant generated no alerts in the last 10 minutes. Lower-severity alerts can take up to 5 minutes to appear in /Alerts; that is expected steady state for a quiet tenant.

Related

• Wiz — alternative CNAPP path.
• AWS Security Hub — alternative cloud finding source if you want native AWS aggregation.

Configuration reference

Field	Label	Type	Required	Default	Notes
account	Account subdomain	string	yes	—	First label of your Lacework console URL: https://<account>.lacework.net
subaccount	Subaccount (optional)	string	no	—	—
key_id	Access Key ID	string	yes	—	—
secret	Secret Key	secret	yes	—	encrypted at rest

Credential handling

secret is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API. See credential vault.