Workday Sign On Event Collector

Use the Workday Sign On Event Collector integration to get sign on logs from Workday.

Analytics & SIEM · Workday

Details

IDWorkday Sign On Event Collector
ProviderWorkday
CategoryAnalytics & SIEM
From Version8.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM Cloud Posture Security

README

Use the Workday Sign On Event Collector integration to get sign on logs from Workday.
This integration was integrated and tested with version v37.0 of Workday Sign On Event Collector.

Configure Workday Sign On Event Collector in Cortex

Parameter Description Required
Server URL (e.g., https://services1.myworkday.com) API Endpoint of Workday server. Can be obtained from View API Clients report in Workday application. True
Tenant Name The name of the Workday Tenant. Can be obtained from View API Clients report in Workday application. True
API Version Some tenants may be using different API versions. Check in your Workday tenant to determine the version to use. Default is v40.0. False
Username   True
Password   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Max events per fetch The maximum number of sign on events to retrieve. Large amount of events may cause performance issues. False
Events Fetch Interval   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

workday-get-sign-on-events

Returns sign on events extracted from Workday. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.

Base Command

workday-get-sign-on-events

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required
limit The maximum number of events to return. Default is 1000. Optional
from_date The date and time of the earliest event. The default timezone is UTC/GMT. The time format is “{yyyy}-{mm}-{dd}T{hh}:{mm}:{ss}Z”. Example: “2021-05-18T13:45:14Z” indicates May 18, 2021, 1:45PM UTC. Optional
to_date The time format is “{yyyy}-{mm}-{dd}T{hh}:{mm}:{ss}Z”. Example: “2021-05-18T13:45:14Z” indicates May 18, 2021, 1:45PM UTC. Optional
relative_from_date The query from date, for example, “5 minutes”. Be advised, it is strongly suggested to keep this parameter limited in time. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • base_url — Server URL (e.g., https://services1.myworkday.com) (required)
  • tenant_name — Tenant Name (required)
  • api_version — API Version
  • credentials — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • max_fetch — Max events per fetch
  • eventFetchInterval — Events Fetch Interval

Commands (1)

  • workday-get-sign-on-events

    Returns sign on events extracted from Workday. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.

Source

WorkdaySignOnEventCollector.py WorkdaySignOnEventCollector_test.py WorkdaySignOnEventCollector.yml WorkdaySignOnEventCollector_description.md command_examples.txt
Download History Raw 
## Workday Event Collector

Use this integration to collect Signon events automatically from Workday.

In order to use this integration, you need to enter your Workday credentials in the relevant integration instance parameters.

The API Endpoint of Workday server can be obtained from View API Clients report in Workday application.