How Synqly Labs works

This page explains where Labs data comes from, what happens to the changes you make, and where Labs behaves differently from the real provider. Read it when Labs gives you an answer you did not expect.

Every provider in Labs serves synthetic data about the same fictional company, ACME Corp. The company has tens to hundreds of each kind of record: devices, users, groups, alerts, indicators, and so on.

Because the company is shared, the providers agree with each other. A device that more than one provider reports, such as a laptop in both CrowdStrike and Claroty, has the same hostname, IP address, and MAC address in each. This lets you test workflows that join data across providers, such as matching an EDR alert to an asset record.

The company keeps working while you use it. New activity, such as alerts, sign-ins, and endpoint events, arrives every 5 minutes, and records change over time: a device goes offline, or a user's status changes. A query for the last hour returns recent data on any day.

The data uses names and addresses that are reserved for documentation, so it can't be mistaken for real data:

• Hostnames and email addresses use the acme.example domain.
• Public IP addresses come from the ranges set aside for documentation (192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24) and for benchmarking (198.18.0.0/15).
• Internal IP addresses use private address ranges.

Labs keeps changes per Synqly account. Your organization can have many accounts, usually one for each of your customers, and each account has its own copy of ACME Corp. When an integration makes a change, such as creating an indicator, quarantining a device, or disabling a user, every integration in the same account sees it. Integrations in your other accounts, and in other organizations, keep seeing the original data.

Your changes behave the way they would on the real provider:

• A record you create appears in later queries.
• A change to a record, such as a device's network state, appears the next time you read it.
• A record you delete disappears from your account's queries. Other accounts still see it.

Labs keeps an account's changes for 15 days, counted from the first change in that account. After that, the account returns to the original data, even if you are still using it. Write your tests so they create the data they need instead of relying on changes from an earlier run.

Labs aims to answer every request the way the provider would, but there are a few cases where it does not.

Some operations a connector supports are not available on Labs yet. A request to one of them returns 501 Not Implemented with a message that names the operation. The main gaps are:

• CrowdStrike Real Time Response (execute_command, execute_remote_script, and retrieve_file).
• SentinelOne Remote Ops (execute_command and retrieve_file).
• Exclusions and policies on CrowdStrike and SentinelOne (query_exclusions and query_policies).
• Alert updates (update_alert) on SentinelOne. On CrowdStrike, only comments are available.
• SentinelOne cloud security compliance findings, IOMs, and threats.

Each provider's Labs page has the full list.

A small number of filters and sorts return an error or the wrong results on Labs. Each provider's Labs page lists them under Not on Labs. The list shrinks as they are fixed.

When Labs rejects a request, the error has the same format the provider uses. The connector reports it to you the same way it would report an error from the real provider.

• Synqly Labs: what Labs is and where to find each provider's page.