runZero

Purpose

To connect AirMDR with Pluto Security to retrieve security information and perform supported investigation and response actions using the Pluto API.

Supported Versions

Component	Supported configuration
Pluto Security	Pluto Security cloud platform
US tenant	Default tenant; leave Base URL empty in AirMDR
EU tenant	`https://app.eu.pluto.security`
Authentication	Pluto API key
Required token prefix	`pluto_`
Transport	HTTPS
API version	Not displayed in the integration configuration; AirMDR uses the API supported by the connector

Pluto rejects tokens that do not begin with the pluto_ prefix.

Authentication

The integration uses a Pluto API key as the API token.

Credential	Required	Description	Example
API Token	Yes	Pluto API key generated from the Pluto console. The key must begin with `pluto_`.	`pluto_xxxxxxxxxxxxxxxx`
Base URL	Conditional	Required only when connecting to the EU tenant. Leave empty for the default US tenant.	`https://app.eu.pluto.security`

API key access

According to the AirMDR configuration guidance, the Pluto API key:

Authenticates requests to Pluto read endpoints.
Authorizes supported issue-triage operations.
Authorizes supported tagging operations.
Authorizes supported add-on scanning operations.
Attributes supported write operations to the API key in the Pluto audit log.

Role-based access considerations

Use a Pluto account authorized to access Integrations and manage API keys.
Restrict API-key generation to approved administrators.
If Pluto supports configurable key permissions, enable only the permissions required by the AirMDR integration.
Do not generate the key from a personal account that may be disabled or removed unexpectedly.
Review all write actions associated with the API key through the Pluto audit log.

Pre-requisites

An active Pluto Security tenant and access the Integrations page in the Pluto console.

Determine whether your organization uses the US or EU Pluto tenant.

Pluto API keys provide access to read endpoints and supported write operations. Generate the key from an appropriately controlled administrative account.

Setup Steps

Generate an API token in Pluto Security

Sign in to your organization’s Pluto Security console.
Open the Integrations page.
Locate the Pluto API section.
Select the available option to create a new API key.
The exact create-key button label may vary between Pluto UI versions.
If prompted, enter a recognizable name for the key, such as: AirMDR-Production.
Create the API key.
Copy the generated key and store it temporarily in an approved secrets-management system.
Verify that the key begins with the required prefix: pluto_.
Record the key owner, purpose, creation date, and planned rotation date.

Treat the API key as a password. Do not add it to documentation, tickets, source-control repositories, chat messages, or screenshots.

Determine the Base URL

The Base URL is determined by your Pluto tenant region; it is not separately generated.

Pluto tenant	AirMDR Base URL value
Default US tenant	Leave the field empty
EU tenant	`https://app.eu.pluto.security`

Sign in to Pluto Security.
Check the hostname displayed in the browser address bar.
If the hostname is app.eu.pluto.security, use: https://app.eu.pluto.security.
If your organization uses the default US tenant, leave the Base URL field empty in AirMDR.
If your organization uses a custom or different hostname, contact Pluto Support or your Pluto administrator before proceeding.

Do not enter https://pluto.security as the Base URL. This is Pluto’s public website, not the tenant value specified for this integration.

Pluto Credential Reference Table

AirMDR Field	What to Enter	Where to Get It in the Pluto Security UI	Example
Instance	A unique name for the Pluto connection	User-defined in AirMDR	`Pluto-Production`
Organization	The AirMDR organization associated with the integration	Select the appropriate organization from the AirMDR Organization list	`AirMDR Organization`
Description	A brief description of the connection	User-defined in AirMDR	`Pluto Security production integration`
API Token	The Pluto API key beginning with the `pluto_` prefix	In the Pluto console, navigate to Integrations → Pluto API, and create an API key	`pluto_xxxxxxxxxxxxxxxx`
Base URL	The Pluto tenant URL for an EU-hosted organization. Leave this field empty for the default US tenant	Identify the tenant region from the Pluto console URL displayed in the browser address bar	EU: `https://app.eu.pluto.security`US: Leave empty

Copy the API key immediately after generating it and store it securely. Do not include the key in documentation, screenshots, source code, or support tickets.

Validate Connectivity

Use the following request to confirm a read-only Pluto API endpoint to confirm that the Base URL and API token can access the tenant:

Sample Request

curl --request GET \
  --url "https://app.eu.pluto.security/<read-only-endpoint>" \
  --header "<authentication-header>: pluto_REPLACE_WITH_API_TOKEN" \
  --header "Accept: application/json"

Sample Response

{
  "status": "success",
  "data": []
}

Validation results

Result	Meaning	Recommended action
`200 OK`	The Base URL and API token are valid	Save the connection and run a read-only AirMDR skill
`401 Unauthorized`	The API token is invalid, expired, or revoked	Generate or enter a valid token beginning with `pluto_`
`403 Forbidden`	The token does not have the required access	Review the API-key permissions
`404 Not Found`	The endpoint or Base URL is incorrect	Confirm the Pluto API endpoint and tenant region
Connection timeout	Pluto cannot be reached from AirMDR	Review DNS, proxy, firewall, and Remote Agent settings

The response structure above is illustrative. Replace it with the actual response returned by the confirmed Pluto endpoint.

Run credential tests only from an approved administrative system. Do not expose the API token through shell history, screenshots, terminal recordings, or logs.

Configure Pluto in AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select ADMIN → Integrations.
Use the search option, enter the keyword “Pluto”, select the Connections tab, and click + New Connection button.

Use the following values in the AirMDR integration configuration screen:

AirMDR field	Required	Description	Example
Instance	Yes	Unique name used to identify the connection	`Pluto-Production`
Organization	Yes	AirMDR organization associated with the connection	`ASO – AirMDR System Organization`
Description	Yes	Short description of the connection’s purpose	`Pluto Security production integration`
API Token	Yes	API key generated from the Pluto console	`pluto_xxxxxxxxxxxxxxxx`
Base URL	Conditional	EU tenant URL; leave empty for the default US tenant	`https://app.eu.pluto.security`

Expand Advanced Configuration if required. (Optional)

In Remote Agent, select an AirMDR Remote Agent only when the Pluto tenant must be accessed through an approved private network route, proxy, or controlled network environment. For publicly accessible Pluto SaaS tenants, leave this field unselected unless instructed otherwise by your AirMDR administrator.
In Expiry, select the date on which AirMDR should treat the stored Pluto credentials as expired, according to your organization’s credential-rotation policy.

The Expiry date controls credential validity in AirMDR. It does not automatically rotate or revoke the API key in Pluto Security. Generate a replacement key in Pluto, update the AirMDR connection, validate it, and then revoke the previous key.

Click Save.

Skills provided by this Integration

Inventory and Discovery

These read-only skills retrieve AI asset inventories, discovered tools, and web-domain activity.

Skill ID	Purpose	Minimum Pluto Role	Required Access
`get_pluto_inventory`	Retrieves records from Pluto’s AI inventories, including builders, applications, MCP servers, browser extensions, AI assistants, AI models, skills, VPNs, remote-access tools, and packages.	API user with inventory-view access	Read access to the selected Pluto inventory type
`get_pluto_discovered_tools`	Retrieves the organization’s discovered-tool catalogue and associated approval tags, including Approved, Rejected, and In Review.	API user with discovered-tool access	Read access to discovered tools and their tags
`get_pluto_web_domain_summary`	Summarizes web domains accessed by AI agents, including allowed and blocked activity and unique-user counts.	API user with agent-activity access	Read access to web-domain activity and policy results

When retrieving inventory for a specific system or user, provide hostname or user_email to limit the result set.

Issue Investigation and Response

These skills retrieve Pluto security issues and write investigation outcomes back to Pluto.

Skill ID	Purpose	Minimum Pluto Role	Required Access
`get_pluto_issues`	Retrieves Pluto security issues for investigation and supports filtering by duration, status, severity, issue type, server, or entity.	API user with issue-view access	Read access to Pluto issues and affected-host information
`update_pluto_issue`	Updates an issue’s status, risk level, or assignees after investigation.	API user authorized to modify issues	Write access to issue status, risk level, and assignee fields
`manage_pluto_issue_comment`	Creates, updates, or deletes investigation comments in the Pluto issue timeline.	API user authorized to manage issue comments	Write access to issue comments

In update_pluto_issue, assignee_emails and assignee_ids replace the existing assignee list. Use clear_assignees to remove all existing assignees.

AI Agent Activity and Audit

These read-only skills support investigation of AI coding-agent activity and organization-level audit events.

Skill ID	Purpose	Minimum Pluto Role	Required Access
`get_pluto_claude_code_session_events`	Retrieves Claude Code session events, including prompts, tool results, API requests, errors, permission decisions, token usage, and endpoint context.	API user with Claude Code activity access	Read access to Claude Code session events
`get_pluto_agentic_tool_hook_events`	Retrieves hook events from supported AI coding tools, including Claude Code, Cursor, Codex, Windsurf, VS Code, and Copilot Studio.	API user with agent-event access	Read access to agent hook events and policy decisions
`get_pluto_audit_log`	Retrieves Pluto audit activity such as logins, policy changes, tag updates, integration changes, automation changes, issue updates, and data access.	API user with audit-log access	Read access to the Pluto organization audit log

Pluto rejects Claude Code session-event and agentic-hook queries with a time window greater than 14 days. Use a duration of 14d or less.

Governance and Inventory Management

These skills manage approval tags, inventory metadata, and organization-level business context.

Skill ID	Purpose	Minimum Pluto Role	Required Access
`manage_pluto_tags`	Creates an organization tag or assigns and removes an existing tag from a Pluto entity.	API user authorized to manage tags	Read and write access to organization tags and supported entities
`update_pluto_inventory_metadata`	Adds a review comment or updates the risk level of a supported inventory entity.	API user authorized to modify inventory metadata	Write access to inventory comments and supported risk-level fields
`get_or_update_pluto_business_context`	Retrieves or replaces the organization’s customer-supplied business description used by Pluto for risk detection and classification.	API user authorized to view or manage organization context	Read access to retrieve context; write access to replace or clear it

Pluto returns 403 Forbidden when tagging is disabled for the organization. IDE-extension tags are managed by Pluto and cannot be changed through the API.

Inventory metadata limitations

risk_level can be updated only for builder and application entity types.
Use comment when updating other supported entity types.
Passing an empty business_context value clears the existing business-context field.
The business-context value is limited to 4,000 characters.
The Pluto-managed org_info field is not modified by the business-context skill.

AI Add-on Security Scanning

These skills submit MCP servers or agent skills for scanning and retrieve their results.

Skill ID	Purpose	Minimum Pluto Role	Required Access
`submit_pluto_addon_scan`	Submits an MCP server or agent skill to Pluto Studio for asynchronous security scanning.	API user authorized to submit scans	Write access to Pluto Studio scan-submission endpoints
`get_pluto_addon_scan`	Retrieves the status and result of a previously submitted MCP-server or agent-skill scan.	API user with scan-result access	Read access to Pluto Studio scan results

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → Pluto Integration page.
Select the Skills tab and click on the required listed skills.

Permission Summary

Access category	Included skills
Read-only API access	`get_pluto_inventory`, `get_pluto_discovered_tools`, `get_pluto_web_domain_summary`, `get_pluto_issues`, `get_pluto_claude_code_session_events`, `get_pluto_agentic_tool_hook_events`, `get_pluto_audit_log`, `get_pluto_addon_scan`
Conditional read/write access	`get_or_update_pluto_business_context`
Write access	`update_pluto_issue`, `manage_pluto_issue_comment`, `manage_pluto_tags`, `update_pluto_inventory_metadata`, `submit_pluto_addon_scan`
Administrative UI approval	Approval or rejection of completed add-on scans in the Pluto Studio review queue

Additional Information

🧰 Error Handling

Recovery procedure

Confirm the Pluto tenant region.
Verify that the API token begins with pluto_.
Confirm that the token has not been revoked or rotated.
Review the AirMDR connection configuration.
Test a read-only operation.
Review AirMDR execution details and the Pluto audit log.
Generate a replacement key if the existing key cannot be validated.
Contact support if the issue continues.

Symptom	Likely cause	Recovery
API token rejected	Token does not begin with `pluto_`	Generate a valid Pluto API key and update the AirMDR connection
`401 Unauthorized`	Invalid, expired, rotated, or revoked token	Confirm the active key and replace the stored token
`403 Forbidden`	API key or associated account lacks access	Review key permissions and Pluto role assignments
Connection fails only for EU tenant	Base URL is missing or incorrect	Enter `https://app.eu.pluto.security`
Default US connection fails	An EU Base URL was entered for a US tenant	Remove the Base URL and save the connection again
`404 Not Found`	Incorrect tenant URL or unsupported resource	Confirm the tenant region and skill compatibility
TLS or certificate error	Proxy, certificate inspection, or trust-store issue	Validate the certificate chain and outbound proxy settings
DNS or timeout error	Network or firewall restriction	Permit outbound HTTPS access to the Pluto tenant
`429 Too Many Requests`	Pluto API request limit reached	Reduce request frequency and retry with an appropriate delay
Read succeeds but write fails	Write access is unavailable or restricted	Review the API key’s permissions and the Pluto audit log
Key creation option is unavailable	User role cannot manage API keys	Contact a Pluto administrator

🔄 Monitoring & Logs

Pluto audit logUse the Pluto audit log to review supported write operations executed through the API key, including:

Issue-triage activity.
Tagging operations.
Add-on scanning requests.
Identity or API key associated with the action.
Timestamp and action status, where available.

The exact navigation path for the audit log may depend on the Pluto UI version and your role.AirMDR logsUse AirMDR integration and skill-execution records to review:

Connection-test results.
Skill execution status.
Request failures.
Authentication errors.
Response codes.
Retry attempts.

Illustrative log entriesThe following entries are examples only and do not represent Pluto’s exact log format.

INFO  Pluto connection validated successfully
INFO  Pluto read operation completed status=200
WARN  Pluto request temporarily unavailable retry_attempt=1
ERROR Pluto authentication failed status=401
ERROR Pluto authorization failed status=403

Recommended log levels

Level	Recommended use
INFO	Successful connection tests, completed requests, and normal operations
WARN	Retryable failures, temporary unavailability, or approaching rate limits
ERROR	Invalid credentials, authorization failures, and unsuccessful skill executions
DEBUG	Temporary troubleshooting only; API tokens must remain redacted

Never record the API token, authorization header, or complete credential payload in logs.

🛑 Security & Access Best Practices

✅ Do

Use a dedicated API key for AirMDR.
Apply least-privilege access wherever Pluto supports configurable permissions.
Store the key in an approved secrets-management system.
Rotate the API key according to your organization’s security policy.
Monitor write operations through the Pluto audit log.
Restrict integration administration to authorized users.
Test configuration changes with a read-only action first.
Revoke the API key immediately if exposure is suspected.
Keep production and non-production credentials separate.
Review integration access after administrator or employee changes.

❌ Don’t

Sharing the API key through email, Slack, tickets, or documents.
Storing the token in scripts or source-control repositories.
Reusing a key assigned to another integration.
Entering the public https://pluto.security website as the API Base URL.
Using the EU Base URL for a default US tenant.
Capturing the API token in screenshots or logs.
Disabling TLS certificate validation.
Leaving unused or former integration keys active.

👉 Support & Maintenance

📧 Contact AirMDR Support through your designated support channel.
🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
🔄 Reconnect in AirMDR immediately when API Keys are changed.
Use the official Pluto Security contact page, Pluto also identifies info@pluto.security as a contact address in its published terms.

🛑 Data Flow & Security

Data exchangedDepending on the selected AirMDR skill, the integration may exchange:

Requests for supported Pluto security information.
Issue and finding identifiers.
Issue-triage instructions.
Tags and tag updates.
Add-on scanning requests.
Status information and API responses.
Error codes and troubleshooting details.

The exact fields exchanged depend on the AirMDR skill being executed.Encryption

Area	Guidance
Data in transit	AirMDR connects to Pluto using an HTTPS endpoint.
Data at rest	Verify Pluto’s current encryption-at-rest controls through the Pluto Trust Center or your Pluto representative.
Credential storage	Store the API token only in AirMDR’s protected credential field and an approved secrets-management system.
TLS inspection	Ensure that any proxy or TLS-inspection control does not invalidate the Pluto certificate chain.

Pluto provides a public Trust Center for security and compliance information. Access to detailed reports may require authorization.Ports and endpoints

Direction	Protocol and port	Destination
AirMDR to Pluto	HTTPS/TCP 443	Organization’s Pluto tenant
EU tenant	HTTPS/TCP 443	`app.eu.pluto.security`
Default US tenant	HTTPS/TCP 443	Tenant endpoint managed by the AirMDR connector when Base URL is empty

If your organization uses IP allowlisting, a proxy, or restricted outbound access, obtain the current destination information from Pluto or AirMDR Support.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

API key access

Pre-requisites

Setup Steps

Pluto Credential Reference Table

Validate Connectivity

Configure Pluto in AirMDR Integrations Dashboard

Skills provided by this Integration

Permission Summary

Additional Information

​API key access

​Pre-requisites

​Setup Steps

​Pluto Credential Reference Table

​Validate Connectivity

​Configure Pluto in AirMDR Integrations Dashboard

​Skills provided by this Integration

​Permission Summary

​Additional Information

API key access

Pre-requisites

Setup Steps

Pluto Credential Reference Table

Validate Connectivity

Configure Pluto in AirMDR Integrations Dashboard

Skills provided by this Integration

Permission Summary

Additional Information