CelonisEventCollector

The Celonis Platform offers you a suite of process mining and intelligence features, helping you to integrate your data and then use that data to analyze, improve, and monitor your business performance across key metrics.

Analytics & SIEM · Celonis

Details

IDCelonisEventCollector
ProviderCelonis
CategoryAnalytics & SIEM
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesXSIAM

README

Celonis Event Collector is an integration that supports fetching audit log events.
This integration was integrated and tested with version 4.0 of Celonis.

Configure Celonis in Cortex

Parameter Description Required
Server URL The endpoint URL is constructed using the team name and realm in the format: https://<teamname>.<realm>.celonis.cloud. True
Server URL The endpoint URL is constructed using the team name and realm in the format: https://<teamname>.<realm>.celonis.cloud. True
Client ID The Client ID to use for connection. True
Client Secret The Client Secret to use for connection. True
Trust any certificate (not secure)   False
Use system proxy settings   False
Maximum number of events per fetch Defines the maximum number of audits events per fetch cycle. Default value: 600. True

API keys, passed in an HTTP header like this: Authorization: Bearer API_KEY.

How to create an OAuth client and generate client ID and Client Secret

  1. To start, you need to create an OAuth client in your team and then grant this client API permissions.
  2. Click Admin & Settings and select Applications.
  3. Click Add New Application - OAuth client and create your OAuth client.
    When creating your OAuth client, use the following configurations: Authentication method: Client secret post.
  4. Select the following scopes:
    • audit.log:read (For the Audit Log API).
    • platform-adoption.tracking-events:read (For the Studio Adoption API).
    • team.login-history:read (For the Login History API).
  5. Click Create and then copy the client ID and client secret to your clipboard for later use.
  6. Click Permissions and edit Team permissions.
  7. Assign Audit Log API, *Login History API, and Studio Adoption APIs permissions to your newly created application as required.
  8. Click Save.
    The OAuth client now has the relevant API permissions.

For more information visit Celonis Audit Logs Documentation.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

celonis-get-events

Retrieves a list of audit logs events from the Celonis instance.

Base Command

celonis-get-events

Input

Argument Name Description Required
should_push_events Set this argument to true in order to create events, otherwise it will only display them. Possible values are: true, false. Default is false. Required
limit Maximum number of events to return. Required
start_date The starting date from which events should be fetched. The date should be in the format “YYYY-MM-DDTHH:MM:SS.sssZ”. Example: 2025-02-04T10:33:24.647Z. Required
end_date The date up to which events should be fetched. The date should be in the format “YYYY-MM-DDTHH:MM:SS.sssZ”. Example: 2025-02-04T10:33:24.647Z. Required

Context Output

Path Type Description
Celonis.Audit List The list of audit logs events.

Command example

!celonis-get-events should_push_events=false limit=10 end_date=2025-02-04T10:33:24.647Z start_date=2025-02-10T10:33:24.647Z

Configuration parameters

  • url — Server URL (required)
  • credentials — Client ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetchEvents — Fetch events
  • max_events_per_fetch — Maximum number of events per fetch (required)

Commands (1)

  • celonis-get-events

    Retrieves a list of audit logs events from the Celonis instance.

Source

CelonisEventCollector.py CelonisEventCollector_test.py CelonisEventCollector.yml CelonisEventCollector_description.md command_examples.txt
Download History Raw 
!celonis-get-events should_push_events=false limit=10 end_date=2025-02-04T10:33:24.647Z start_date=2025-02-10T10:33:24.647Z