> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# KnowBe4 integration setup

> Connect KnowBe4 to the Living Security Platform to import users, training enrollments, and phishing security test results.

export const PublicIntegrationNextSteps = () => <>
    <hr />
    <h2>Related resources</h2>
    <ul>
      <li>
        <a href="/signals/data-sources">Learn how integration data becomes Human Risk Management signals</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/integrations">Explore Living Security integrations</a>
      </li>
      <li>
        <a href="https://app.livingsecurity.ai/">Open the Living Security Platform</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/request-demo/">Request a Living Security demo</a>
      </li>
    </ul>
  </>;

export const EgressIpSafelist = ({system}) => <Note>
    <strong>Add all four Living Security sync egress IP addresses</strong> to the allowlist in{' '}
    {system}. Enter each as a single host with <code>/32</code> if {system} expects CIDR notation:
    <br />
    <code>52.34.139.153/32</code>, <code>54.69.127.183/32</code>, <code>44.247.133.183/32</code>,{' '}
    <code>52.26.211.56/32</code>
    <br />
    <br />
    Traffic can leave from any of the four, so allowlisting only some of them causes intermittent
    sync failures. These four are the same in every Living Security region. See{' '}
    <a href="/integrations/managing/egress-ip-addresses">
      Configuring Integration Egress IP Addresses
    </a>{' '}
    for the full list, change policy, and troubleshooting.
  </Note>;

export const ConnectInPlatform = ({tile, children}) => <Step title="Enter the credentials in the Living Security Platform">
    <p>
      Completed by whoever holds Living Security access — the program owner, or the system
      admin if they've been invited (delegated setup).
    </p>
    <ol>
      <li>
        Go to <strong>Settings → Integrations → Catalog</strong>, find the{' '}
        <strong>{tile}</strong> tile, click <strong>Connect</strong>.
      </li>
      <li>
        Fill in the fields below, then click <strong>Connect</strong>.
      </li>
    </ol>
    {children}
  </Step>;

export const SystemAdminBanner = ({system, recommendDelegated}) => <Note>
    <p>
      <strong>This guide is for your {system} administrator.</strong> It covers creating API
      credentials inside {system}, which requires admin access to {system} — not to the
      Living Security Platform.
    </p>
    <p>
      If you're the Living Security <strong>program owner</strong> and don't administer {system},
      send this page to whoever does. They complete Part A and hand the credentials back to you
      (or enter them directly if you've invited them into the platform).
      {recommendDelegated && <>
          {' '}Because setup produces sensitive key material, we recommend the{' '}
          <strong>delegated setup</strong> path so the secret is never sent back to you.
        </>}
    </p>
  </Note>;

<SystemAdminBanner system="KnowBe4" />

## What this integration contributes

KnowBe4 can contribute workforce, training, and phishing-simulation outcomes. Reviewed examples include:

* `training.completed` — completes security training
* `training.past.due` — has overdue training
* `phishing.simulation.clicked` — clicked a simulation without reporting

These examples show the types of normalized activity Living Security can use. See [how integration data becomes signals](/signals/data-sources).

## What Living Security needs

| Credential                      | Description                                                                                                                           |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **API key**                     | A Reporting API bearer token generated under **Account Settings → API**. Sent on every request in the `Authorization: Bearer` header. |
| **Reporting API server region** | The region your KnowBe4 account is provisioned on, chosen from a list (US, EU, Canada, UK, Germany).                                  |

**Scopes:** None to configure — KnowBe4 Reporting API tokens are read-only by design and are not scoped. The token grants read access to users, training enrollments, and phishing security test results, which is exactly what the sync reads.

**Required role:** **Account Admin** in KnowBe4 (only account administrators can access **Account Settings → API**)

### Prerequisites

* You must be signed in to your KnowBe4 console with an **Account Admin** role. Only account administrators can access **Account Settings → API** to enable the Reporting API and generate tokens.

***

## Part A — In KnowBe4

*Your KnowBe4 administrator completes these steps.*

<Steps>
  <Step title="Enable the Reporting API and generate a token">
    1. Sign in to your KnowBe4 console.
    2. Click your account name in the top-right corner and select **Account Settings**.
    3. In the left navigation, select **API**.
    4. Enable the **Reporting API** if it is not already enabled, then generate a new API token.

    Give the token a descriptive purpose (e.g., `Living Security Platform`) if your console prompts for one.

    <Warning>
      KnowBe4 displays the API token value **only once** when it is generated. Copy it immediately and store it in a secure location (e.g., a password vault or secrets manager). If you navigate away without copying it, you must generate a new token.
    </Warning>

    <Note>
      The Reporting API is read-only. It exposes users, training enrollments, and phishing security test results — the data Living Security ingests for scoring and reporting. No write access is required.
    </Note>
  </Step>

  <Step title="Add the Living Security egress IPs to the Allowed IP Addresses list">
    KnowBe4 lets you restrict Reporting API access to a specific set of source IP addresses. This setting lives in the same place as the token:

    1. In your KnowBe4 console, go to **Account Settings → API → Allowed IP Addresses**.
    2. Add each [Living Security egress IP address](/integrations/managing/egress-ip-addresses) to the allowlist. The same four addresses apply in every region.

    <EgressIpSafelist system="KnowBe4" />

    <Warning>
      **If the Allowed IP Addresses list is configured, it is enforced at the network layer.** The connection dialog will succeed at authentication time, but data syncs will fail (blocked at the network layer, typically surfacing as a `403`) until the Living Security egress IPs are added to the allowlist. If you add any address to this list, you must also add the Living Security ranges, or our requests will be rejected even though your token is valid.
    </Warning>

    <Note>
      Living Security's egress IP addresses can change when infrastructure is updated, though we keep such changes rare. If data syncs begin failing after previously working, check [Configuring Integration Egress IP Addresses](/integrations/managing/egress-ip-addresses) and verify the Allowed IP Addresses list matches.
    </Note>
  </Step>

  <Step title="Identify your KnowBe4 server region">
    KnowBe4 serves the Reporting API from a region-specific host. You select your region in the connection dialog rather than typing a hostname:

    | Region         | Reporting API host   |
    | -------------- | -------------------- |
    | United States  | `us.api.knowbe4.com` |
    | Europe         | `eu.api.knowbe4.com` |
    | Canada         | `ca.api.knowbe4.com` |
    | United Kingdom | `uk.api.knowbe4.com` |
    | Germany        | `de.api.knowbe4.com` |

    If you are unsure which region your account uses, check the domain of your KnowBe4 console URL or contact your KnowBe4 administrator.

    <Note>
      These five regions are the ones Living Security can reach. If your KnowBe4 account is on another server (for example a US Government instance), contact Living Security support before starting the connection.
    </Note>
  </Step>
</Steps>

***

## Part B — In the Living Security Platform

*The program owner completes this step, or the system admin if using delegated setup.*

<Steps>
  <ConnectInPlatform tile="KnowBe4">
    | Field                           | Value                                                |
    | ------------------------------- | ---------------------------------------------------- |
    | **API key**                     | The Reporting API token from Part A, Step 1          |
    | **Reporting API server region** | The region from Part A, Step 3 (e.g., United States) |
  </ConnectInPlatform>
</Steps>

You are now connected to KnowBe4.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    The API token is invalid or expired. Verify the token is correct and has not been regenerated in **Account Settings → API**.
  </Accordion>

  <Accordion title="403 Forbidden">
    Either the token lacks Reporting API access, or the request IP is not on the Allowed IP Addresses list. Verify the Reporting API is enabled and that all four [Living Security egress IP addresses](/integrations/managing/egress-ip-addresses) are on the allowlist.
  </Accordion>

  <Accordion title="Empty results (200 OK but no data)">
    The Reporting API may not yet have data to return, or the token's account lacks visibility into the users and campaigns Living Security ingests. Verify the token was generated by an Account Admin.
  </Accordion>
</AccordionGroup>

<PublicIntegrationNextSteps />