> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring a Custom BlueApp for Use with Your USM Anywhere

LevelBlue provides the opportunity to configure your own custom BlueApps to better monitor activity in your USM Anywhere environment. You can use custom BlueApps to extend the threat detection and response capabilities of the USM Anywhere platform according to your needs. Import data from products and services that use a Representational State Transfer (REST) API by configuring your custom BlueApp using basic authentication, an API key, or OAuth2.

<Warning>
  **Important:** Custom BlueApps connect using dynamic IP addresses. LevelBlue recommends that you allow BlueApps outbound access across all IP addresses.
</Warning>

**To configure a custom BlueApp**

1. Go to **Data Sources > BlueApps > Custom Apps**.

   <Frame>
     <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/custom-alienapp/my-custom-apps.webp?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=212868bffe7ddee781ac9150d215e158" width="1086" height="927" data-path="images/usm-anywhere/alienapps/custom-alienapp/my-custom-apps.webp" />
   </Frame>

2. Click **Add Custom App** to begin creating your new BlueApp.

3. On the App Information and Mapping page, give your BlueApp a name and some identifying information.

   <Frame>
     <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/custom-alienapp/1-app-information.webp?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=43b44644a0536d8de479708022dc007f" width="1203" height="744" data-path="images/usm-anywhere/alienapps/custom-alienapp/1-app-information.webp" />
   </Frame>

   * **App Name**: Provide a unique name for your BlueApp.
   * **(Optional) App Description**: Describe the new BlueApp's intent or functionality.
   * **AlienApp Category**: Tag your app with a category, which will help you organize your BlueApps. You can search for BlueApps by category in the Custom App main page.
   * **(Optional) Logo**: You may import a logo for this BlueApp.

4. Click **Save & Next** to save your new BlueApp and begin configuring it.

5. Configure the authentication credentials your BlueApp will use to connect to the third-party application. When you have finished entering your credentials, confirm them by clicking **Test Connection**.

   <Warning>
     Important: This is entirely dependent upon your third-party application. Be sure to make selections in line with the authentication method required by your third-party application.
   </Warning>

   <Frame>
     <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/custom-alienapp/2_api_credentials_blurred.webp?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=c1d01efc86161e23a8eb0907573cb410" width="899" height="843" data-path="images/usm-anywhere/alienapps/custom-alienapp/2_api_credentials_blurred.webp" />
   </Frame>

   <AccordionGroup>
     <Accordion title="If configuring a custom BlueApp via API key">
       1. In the Auth Type drop-down list, select **API Key**.

       2. Enter the necessary connection information for your BlueApp to connect to the API:

          * **Event URL**: The destination address for the API connection.
          * **Header Name and Header Value**: The API authentication key-value pair for your BlueApp to use when connecting to the third-party API.
          * **Request Method**: Select **GET**, **POST**, or **PUT**.

       3. Click **Test Connection** to verify the connection information you have just entered.
     </Accordion>

     <Accordion title="If configuring a custom BlueApp via Basic Authentication">
       1. In the Auth Type drop-down list, select **Basic Auth**.

       2. Enter the necessary connection information for your BlueApp to connect to the API:

          * **Event URL**: The destination address for the authenticated connection.
          * **Username and Password**: The authentication credentials for your BlueApp to use when connecting to the third-party API.
          * **Request Method**: Select **GET**, **POST**, or **PUT**.

       3. Click **Test Connection** to verify the connection information you have just entered.
     </Accordion>

     <Accordion title="If configuring a custom BlueApp via OAuth2">
       1. In the Auth Type drop-down list, select **OAuth2**.
       2. Enter your Event URL.
       3. Use the OAuth2 Auth Type drop-down to select your authentication type, and then enter the information required by that authentication type:

          * **Basic**: Configure the app to authenticate with a username and password.
          * **Client ID and Client Secret**: Configure the app to authenticate with a client ID and secret.
       4. Enter the necessary connection information for your BlueApp to connect to the API:

          * **Client ID and Client Secret**: The authentication credentials for your BlueApp to use when connecting to the third-party API if using client ID and client secret authentication.
          * **Username and Password**: The authentication credentials for your BlueApp to use when connecting to the third-party API if using basic authentication.
          * **Access Token Endpoint**: The access token endpoint for your OAuth2 connection.
          * **Refresh Token Endpoint**: The refresh token endpoint for your OAuth2 connection.
          * **Content Type**: The appropriate content type for your connection.
          * **Request Method**: Select **GET**, **POST**, or **PUT**.
       5. Click **Test Connection** to verify the connection information you have just entered.
     </Accordion>
   </AccordionGroup>

6. Once your credentials have been verified, click Save & Next.

   <Warning>
     **Important:** The credentials you have entered will be validated when you click Test Connection. If they cannot be verified at this step, you must correct them and ensure they are validated before moving on to the next step.
   </Warning>

7. Represent the API configuration your custom AlienApp should expect from your third-party resource.

   <Frame>
     <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/custom-alienapp/3-api-config-new.webp?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=e082fff0251eb16d47e9170feba556aa" width="953" height="605" data-path="images/usm-anywhere/alienapps/custom-alienapp/3-api-config-new.webp" />
   </Frame>

   <Danger>
     **Warning:** This is entirely dependent upon your third-party application. Be sure to make selections in line with the authentication method required by your third-party application.
   </Danger>

   1. Specify the return format, pagination methods, date format, and output format (JSON, XML, or CEF).
   2. Configure the required values your API call may require. When the field is nested in the return under parent fields, use a period to separate parent and child fields.
   3. Configure Headers, Params, and Body as required by the third-party application's API.

   <Note>
     **Note:** If there are any fields you want to be able to filter against, you must configure them under Params.
   </Note>

   Click **Next** to continue.

8. USM Anywhere uses the configuration details from the previous two steps to connect with your third party and extract data fields found in the logs they send. Use this page to configure the mapping details between the third-party application's data fields and fields in USM Anywhere by dragging and dropping from the detected fields to their matching fields in USM Anywhere.

   <Frame>
     <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/custom-alienapp/4-mapping-completed.webp?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=4540cc1232d25dad424ad4ca64a7e335" width="1042" height="791" data-path="images/usm-anywhere/alienapps/custom-alienapp/4-mapping-completed.webp" />
   </Frame>

   * **Found Parameters:** Fields on the left are extracted from logs fetched from your third-party application.
   * **USM Anywhere App Fields:** Fields on the right are the standard USM Anywhere data labels. Users can map multiple found parameters to the same USM Anywhere app field.

   <Warning>
     **Important:** See [**Event Keys**](../../user-guide/events/event-keys) descriptions to help you match extracted fields with standard USM Anywhere data fields.
   </Warning>

   Click **Next** to continue.

9. Select which log fields to include in the Event Details for events your new BlueApp will generate.

   <Frame>
     <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/custom-alienapp/5-summary-fields.webp?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=eeac94c299ddfa922e26d9d673a712b9" width="1042" height="746" data-path="images/usm-anywhere/alienapps/custom-alienapp/5-summary-fields.webp" />
   </Frame>

   Click **Save & Next** to continue.

10. Use the Preview screen to review your custom BlueApp's configuration.

    <Frame>
      <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/custom-alienapp/6-preview-expanded.jpeg?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=72dcb24ce34bf42186ed11520a5e715a" width="1043" height="840" data-path="images/usm-anywhere/alienapps/custom-alienapp/6-preview-expanded.jpeg" />
    </Frame>

    You can use the Back button to navigate to any previous page and make changes.

11. Once you have finalized your BlueApp details and configuration, click **Save & Close** to finish creating your new BlueApp.

After you have finalized and created your custom BlueApp, you can continue to make changes or refine its configuration by returning to the Custom Apps page and opening your BlueApp for editing.
