Workday Event Collector

Details

ID	`Workday Event Collector`
Provider	Workday
Category	Analytics & SIEM
From Version	8.2.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM Cloud Posture Security

README

Use Workday Event Collector integration to get activity loggings from Workday.
This integration was integrated and tested with API v1.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Workday Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g. https://WORKDAY-HOST/ccx/api/privacy/v1/TENANT_NAME)	REST API Endpoint of Workday server. Can be obtained from View API Clients report in Workday application	True
Token endpoint (e.g. https://WORKDAY-HOST/ccx/oauth2/TENANT_NAME/token)	Token endpoint of the Workday server. Can be obtained from View API Clients report in Workday application.	True
Client ID	Copy the Client ID and Secret from the Register API Client for Integrations stage at Workday.	True
Client Secret		True
Refresh Token	Non-expiry Workday API refresh token.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)		False
Max events per fetch	The maximum number of audit logs to retrieve for each event type. For more information about event types see the help section.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

workday-get-activity-logging

Returns activity loggings extracted from Workday.

Base Command

workday-get-activity-logging

Input

Argument Name	Description	Required
limit	The maximum number of loggings to return.. Default is 1000.	Optional
offset	The zero-based index of the first object in a response collection. Default is 0.	Optional
from_date	The date and time of the earliest log entry. The default timezone is UTC/GMT. The time format is “{yyyy}-{mm}-{dd}T{hh}:{mm}:{ss}Z”. Example: “2021-05-18T13:45:14Z” indicates May 18, 2021, 1:45PM UTC. Possible values are: .	Required
to_date	The time format is “{yyyy}-{mm}-{dd}T{hh}:{mm}:{ss}Z”. Example: “2021-05-18T13:45:14Z” indicates May 18, 2021, 1:45PM UTC. Possible values are: .	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.

Context Output

There is no context output for this command.

Command example

!workday-get-activity-logging limit=4 from_date=2023-04-24T07:00:00Z to_date=2023-04-24T08:00:00Z

Human Readable Output

Activity Logging List

Activity Action	Device Type	Ip Address	Request Time	Session Id	System Account	Target	Task Display Name	Task Id	User Activity Entry Count	User Agent
test_action	test_device	1.1.1.1	2023-04-24T07:00:00Z	test_session_id	123	id: 1234 descriptor: test_descriptor href: test_href	test_display	1	1234	test_agent
test_action	test_device	1.1.1.1	2023-04-24T07:00:00Z	test_session_id	123	id: 1234 descriptor: test_descriptor href: test_href	test_display	2	1234	test_agent
test_action	test_device	1.1.1.1	2023-04-24T07:00:00Z	test_session_id	123	id: 1234 descriptor: test_descriptor href: test_href	test_display	3	1234	test_agent
test_action	test_device	1.1.1.1	2023-04-24T07:00:00Z	test_session_id	123	id: 1234 descriptor: test_descriptor href: test_href	test_display	4	1234	test_agent

Configuration parameters

base_url — Server URL (e.g. https://WORKDAY-HOST/ccx/api/privacy/v1/TENANT-NAME) (required)
token_url — Token endpoint (e.g. https://WORKDAY-HOST/ccx/oauth2/TENANT-NAME/token) (required)
credentials — Client ID (required)
token — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Max events per fetch
eventFetchInterval — Events Fetch Interval

Commands (1)

workday-get-activity-logging
Returns activity loggings extracted from Workday. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.

Source

WorkdayEventCollector.py WorkdayEventCollector_test.py WorkdayEventCollector.yml WorkdayEventCollector_description.md command_examples.txt

Download History Raw

## Workday Event Collector

Use this integration to collect activity logs automatically from Workday.

In order to use this integration, you need to enter your Workday credentials in the relevant integration instance parameters.

#### Client ID and Client secret

1. To register the API client, access the Register API Client for Integrations task and provide the relevant parameters.
2. Copy the Client Secret and Client ID

#### Refresh token

1. To generate a refresh token, access the View API Clients task and copy the below two parameters from the top of the page:
   1. Workday REST API Endpoint. The endpoint to use access to the resources in your Tenant.
   2. Token Endpoint. The endpoint used to exchange an authorization code for a token (if you configure authorization code grant).
2. Go to API Clients for Integrations tab hover on the relevant client and click on the three-dot action buttons.
3. In the new pop up window, click API Client > Manage Refresh Token for Integrations.
4. In the Manage Refresh Token for Integrations window, select the relevant integration name in the Workday Account field and click OK.
5. In the newly opened window, select Generate New Refresh Token checkbox and click OK.
6. Copy the value of the Refresh Token column from the opened window and click Done.