> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rulebase.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Unit21

> Add a Unit21 API key so Rulebase syncs cases and alerts with their dispositions, investigator notes, and the rules that fired.

Connect Unit21 to Rulebase to review your Unit21 investigations and use them as the population for compliance testing.

## Prerequisites

* You must have a Unit21 API key with access to the cases and alerts you want reviewed.
* You must have the Administrator role in Rulebase.

## Installation

### Step 1: connect Unit21

1. Log in to your [Rulebase dashboard](https://app.rulebase.co)
2. Go to **Settings** > **Integrations**
3. Find **Unit21** in the list and click **Add**
4. Enter your Unit21 API key
5. Click **Add**

To rotate the key later, or to add the webhook signing secret, open the **...** menu on the connection and choose **Edit**.

## What gets synced

Unit21 cases become Rulebase compliance cases and Unit21 alerts become compliance alerts. Each includes:

* **Title, description, and status**, plus the source the case or alert came from
* **Disposition**, including who dispositioned it, when, and the notes they left
* **Assignee**, so work can be reviewed by investigator
* **Investigator notes, actions, and narratives** recorded in Unit21
* **The rules that fired**, imported as compliance rules and linked to every case and alert that triggered them

Rulebase syncs about every ten minutes and looks for two things: records created since the last run, and records dispositioned since the last run. The second pass keeps a case that was opened last week and closed this morning up to date. The first sync after connecting reaches back twenty-four hours, so a connection made today will not backfill your full case history.

## Webhooks

Unit21 webhooks are optional. Copy the URL from **Copy webhook URL** in the **...** menu on the connection and add the signing secret through **Edit**. Rulebase verifies each event and records it on the connection, then picks the change up on the next scheduled sync, so a missed webhook does not lose data. To see what has arrived, open **View activity** on the connection.

## Use the synced records

Synced cases and alerts are available as population record types when you populate a compliance test, where you can sample by date range and, for alerts, by alert type. See [Populate compliance tests](/guides/compliance/populate-tests) for that workflow.

Which of the two a test draws on is fixed by the program's **Applies to** setting, and a test sheet keeps the columns it was created with, so decide that before you sample anything. [Set up a compliance testing program](/guides/compliance/set-up-a-testing-program) covers defining the program, its controls, and how its population is sampled.