MondayEventCollector

Details

ID	`MondayEventCollector`
Provider	Monday.com
Category	Analytics & SIEM
From Version	8.3.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Collects Monday.com audit logs and activity events for Cortex XSIAM.

Required Permissions

To use this integration, the following permissions are required on the Monday.com app.

boards:read

Activity log

Activity log API docs

Can be accessed using the OAuth method.

Create your Monday app guidelines and make sure the needed permissions are granted for the app registration:
Required scope - boards:read
The Redirect URI - https://localhost

Enter your Client ID and Client Secret in the instance parameter fields.

Run the !monday-generate-login-url command in the War Room and follow the instructions:

To sign in, click the login URL and grant Cortex XSIAM permissions. You will be automatically redirected to a link with the following structure:
REDIRECT_URI?code=AUTH_CODE&region=REGION&scope=boards%3Aread&state=

Copy the AUTH_CODE (without the code= prefix) and paste it in your instance configuration under the Authorization code parameter.

Save the instance.
In the Playground, run the !monday-auth-test command. A ‘Success’ message is generated.

Audit log

Audit log API docs

Generating the API token
To generate the audit log API token, access the admin section of your account, click the “Security” section, and then the “Audit” tab. From there, select the “Monitor by API” button and copy it.

Audit log is an advanced security feature and available on the Enterprise plan and can only be accessed by the account admin.

Configure MondayEventCollector in Cortex

Parameter	Description	Required
Activity logs Server URL		False
Client ID		False
Client secret		False
Authorization code	The code received from the redirect URL after running monday-generate-login-url command. (needed for Activity Logs only)	False
Board IDs	Comma separated list of board IDs. (needed for Activity Logs only)	False
Events Fetch Interval		False
Maximum number of Activity Logs per board per fetch		False
Audit Server URL		False
Audit API token	In the Admin section of your account, click the ‘Security’ section and then the ‘Audit’ tab. Select the ‘Monitor by API’ button.	False
Maximum number of Audit Logs per fetch		False
Fetch events		False
Event types		True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

monday-generate-login-url

Generate the login url used for Authorization code flow.

Base Command

monday-generate-login-url

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!monday-generate-login-url

Human Readable Output

Authorization instructions

To sign in, click the login URL and grant Cortex XSIAM permissions.
You will be automatically redirected to a link with the following structure:
REDIRECT_URI?code=AUTH_CODE&region=REGION&scope=boards%3Aread&state=

Copy the AUTH_CODE (without the code= prefix) and paste it in your instance configuration under the Authorization code parameter.

monday-auth-test

Run this command to test the connectivity to Monday.

Base Command

monday-auth-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!monday-auth-test

Human Readable Output

✅ Success!

Configuration parameters

activity_logs_url — Activity logs Server URL
credentials — Client ID
auth_code —
board_ids — Board IDs
eventFetchInterval — Events Fetch Interval
max_activity_logs_per_fetch — Maximum number of Activity Logs per board per fetch
audit_logs_url — Audit Server URL
audit_token —
max_audit_logs_per_fetch — Maximum number of Audit Logs per fetch
isFetchEvents — Fetch events
selected_event_types — Event types
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (2)

monday-auth-test
Run this command to test the connectivity to Monday.
monday-generate-login-url
Generate the login url used for Authorization code flow.

Source

MondayEventCollector.py MondayEventCollector_test.py MondayEventCollector.yml MondayEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Monday.com
sectionorder:
- Connect
- Collect
commonfields:
  id: MondayEventCollector
  version: -1
configuration:
- display: Activity logs Server URL
  defaultvalue: https://api.monday.com
  name: activity_logs_url
  required: false
  type: 0
  section: Connect
- display: Client ID
  name: credentials
  type: 9
  displaypassword: Client Secret
  section: Connect
  required: false
  additionalinfo: "needed for Activity Logs only"
- displaypassword: Authorization code
  name: auth_code
  type: 9
  section: Connect
  required: false
  display: ''
  hiddenusername: true
  additionalinfo: "The code received from the redirect URL after running the monday-generate-login-url command (needed for Activity Logs only)."
- display: Board IDs
  name: board_ids
  required: false
  additionalinfo: "Comma-separated list of board IDs (needed for Activity Logs only)."
  type: 0
  section: Connect
- display: Events Fetch Interval
  defaultvalue: '1'
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Maximum number of Activity Logs per board per fetch
  defaultvalue: 10000
  section: Collect
  name: max_activity_logs_per_fetch
  required: false
  type: 0
- display: Audit Server URL
  name: audit_logs_url
  required: false
  type: 0
  section: Connect
- displaypassword: Audit API token
  display: ''
  name: audit_token
  type: 9
  section: Connect
  required: false
  hiddenusername: true
  additionalinfo: "In the Admin section of your account, click the 'Security' section and then the 'Audit' tab. Select the 'Monitor by API' button."
- display: Maximum number of Audit Logs per fetch
  defaultvalue: 5000
  section: Collect
  name: max_audit_logs_per_fetch
  required: false
  type: 0
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  defaultvalue: 'true'
  hidden:
  - xsoar
- display: Event types
  defaultvalue: 'Audit Logs,Activity Logs'
  name: selected_event_types
  type: 16
  section: Collect
  required: false
  options:
  - Audit Logs
  - Activity Logs
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Collects Monday.com audit logs and activity events for Cortex XSIAM using OAuth 2.0 authentication.
display: MondayEventCollector
name: MondayEventCollector
script:
  commands:
  - name: monday-generate-login-url
    description: Generate the login url used for Authorization code flow.
    arguments: []
  - name: monday-auth-test
    description: Run this command to test the connectivity to Monday.
    arguments: []
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.3.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam