Bastion runs compliance checks on the security settings of your Mac, Windows and Linux devices. It gets that data from Factorial IT through a read-only Factorial IT API key, so the only job on your side is to create the key and hand it to Bastion.

Feature/Functionality

Overview

Data moves in one direction only. Bastion reads your devices through the Factorial IT API using a read-only key. Factorial IT pushes nothing to Bastion, and nothing from Bastion shows up in the Factorial IT console.

You set up the integration inside Bastion, not in the console. Bastion's own documentation explains which settings it looks at, how often it collects them and how it maps them to its controls.

Before you start

• An MDM plan with device management already configured.
• Access to Settings > Developers in the console, where keys are created.
• An administrator account in Bastion.

How to use

Create a read-only key

1. Go to Settings > Developers and click Create key.
2. Fill in the form:
   • Key name: something you will recognise later, such as Bastion.
   • Access level: Read-only. Bastion never writes anything, so it never needs more.
   • Expiration (days): leave it blank for a key with no end date, or enter a number of days and remember to swap the key in Bastion before it runs out.
3. Click Create key, then Copy secret. You will not see the secret again after this screen.

Connect the key in Bastion

1. Sign in to Bastion and open its Factorial IT API integration.
2. Pick the API key mode and paste the secret.
3. Finish the connection in Bastion. From then on, Bastion pulls device data on its own schedule.

Check that Bastion is reading data

1. Go to Settings > Developers and click See API logs.
2. Look for Bastion's key in the Actor column.

Disconnect Bastion

1. Go to Settings > Developers and find the key in the Factorial IT API keys list.
2. Open the ⋯ menu on that row and click Revoke.

Access stops straight away and a revoked key cannot be brought back. To connect again, create a fresh key and paste it into Bastion.

Troubleshooting and FAQ

Troubleshooting

• Bastion has stopped getting device data. Open the Factorial IT API keys list and check the Status and Expires columns. A key that is revoked or expired stops working immediately. Create a new key and update it in Bastion.
• A device does not appear in Bastion. First check the platform: Bastion only covers macOS, Windows and Linux. Then check that the device is enrolled and reporting to the console. Bastion can only see devices that Factorial IT already knows about.

FAQ

1. Does Bastion send anything back to Factorial IT?
   No. Bastion only reads. None of its data appears in the console.
    
2. Where do I configure what Bastion checks?
   In Bastion. Its documentation covers the settings it collects, how often and how they map to its controls.
    
3. Can I restore a key I revoked by mistake?
   No. Create a new key and paste it into Bastion.
    
4. How do I know Bastion is actually connected?
   Open Settings > Developers > See API logs and look for its key in the Actor column.