OneLogin Event Collector

Details

ID	`OneLogin Event Collector`
Provider	OneIdentity
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Simple customer authentication and streamlined workforce identity operations.

Configure OneLogin Event Collector in Cortex

Parameter	Description	Required
Your server URL		True
Client Id	The client ID.	True
Client Secret	The client secret.	True
The maximum number of events per fetch		False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

onelogin-get-events

Manual command to fetch events from OneLogin and display them.

Base Command

onelogin-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Number of results to return. Maximum is 2000. Default is 10.	Optional
cursor	A string pointing at the next page of results. The cursor can be found within the response_metadata field, as part of the raw response of the OneLogin Events API call.	Optional
since	Occurrence time of the least recent event to include (inclusive). Default is 3 days.	Optional
until	Occurrence time of the most recent event to include (inclusive).	Optional
event_type_id	A comma-separated list of type IDs of events to include.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Your server URL (required)
credentials — Client Id (required)
limit — The maximum number of events per fetch
since — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

onelogin-get-events
Manual command to fetch events and display them.

Source

OneLoginEventCollector.py OneLoginEventCollector_test.py OneLoginEventCollector.yml OneLoginEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: OneIdentity
commonfields:
  id: OneLogin Event Collector
  version: -1
configuration:
- display: Your server URL
  name: url
  required: true
  type: 0
- displaypassword: Client Secret
  display: Client Id
  additionalinfo: The API Key to use for connection.
  name: credentials
  required: true
  type: 9
- display: The maximum number of events per fetch
  name: limit
  type: 0
  defaultvalue: 1000
  required: false
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: since
  type: 0
  defaultvalue: 3 days
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Simple customer authentication and streamlined workforce identity operations.
display: OneLogin Event Collector
name: OneLogin Event Collector
script:
  commands:
  - description: Manual command to fetch events and display them.
    name: onelogin-get-events
    arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: Number of results to return. Maximum is 2000.
      name: limit
      defaultValue: 10
    - description: A string pointing at the next page of results. The cursor can be found within the response_metadata field, as part of the raw response of the OneLogin Events API call.
      name: cursor
    - description: Occurrence time of the least recent event to include (inclusive).
      name: since
      defaultValue: 3 days
    - description: Occurrence time of the most recent event to include (inclusive).
      name: until
    - description: A comma-separated list of type IDs of events to include.
      name: event_type_id
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam