# Gem Alert Source Integration

Gem is an Alert Source integration. The Dropzone platform creates Investigations based on alerts from Alert Sources.

Gem is a SIEM focusing on Cloud Detection and Response (CDR).

## Create an API Key

Dropzone requires a Gem Client ID and Client Secret.

To obtain these, follow the instructions available on Gem's [documentation site](https://docs.wiz.io/) for creating a Client ID and Client Secret.

## Enable Gem

To enable the Alert Source integration, do the following:

- Navigate to your Dropzone AI tenant home page e.g. https:// _mycompany_.dropzone.app
- In the bottom left hand corner, click Settings > Integrations

- Click "Available"

- In the Search bar, search Gem, then click "Configure"

- Input your Gem server domain (e.g. _app.gem.security_, _eu-west-1.app.gem.security_)
- Input the Client ID and Client Secret you created earlier

- Input your desired poll interval and lookback
- Click "Comment Investigation Results to ticket" if you want Dropzone to push investigation results back to Gem

- If you wish to further filter alerts using the Python [CEL](https://python-common-expression-language.readthedocs.io/en/stable/tutorials/cel-language-basics/) package, check the box labeled "Use advanced filtering"
- Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button
- Contact your Dropzone AI support representative for more information about this feature

- Click "Test & Save"

If you have any errors or questions, engage your Dropzone AI support representative.