ZoomEventCollector

Details

ID	`ZoomEventCollector`
Provider	Zoom
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/auth-utils:1.0.0.10133006`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

This is the Zoom event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 2.0.0 of Zoom

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Zoom Event Collector in Cortex

Parameter	Required
Server URL (e.g., ‘https://api.zoom.us/v2/’)	True
Account ID (OAuth)	True
Client ID (OAuth)	True
Client Secret (OAuth)	True
First fetch time (<number> <time unit>, e.g., 12 hours, 7 days) - within the last six months	False
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zoom-get-events

Gets events from Zoom.

Base Command

zoom-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum results to return. The maximum is 300.	Optional

Context Output

There is no context output for this command.

Command Example

!zoom-get-events should_push_events=true limit=1

Human Readable Output

operationlogs Events

action	category_type	operation_detail	operator	time
Delete	User	Delete User example@example.com	example@example.com	2023-01-16T09:51:59Z

activities Events

client_type	email	ip_address	time	type	version
Browser	example@example.com	8.8.8.8	2023-01-19T14:44:23Z	Sign in	-

Rate Limits

To prevent abuse and ensure service stability, all API requests are rate limited. Rate limits specify the maximum number of API calls that can be made in a minute period. The exact number of calls that your application can make per minute varies based on company plan.
For more information, please refer to the Zoom API documentation on Rate limits by account type.

Configuration parameters

url — Server URL (e.g., 'https://api.zoom.us/v2/') (required)
account_id — Account ID (OAuth) (required)
credentials — Client ID (OAuth) (required)
first_fetch — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days) - within the last six months
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

zoom-get-events
Gets events from Zoom.

Source

ZoomEventCollector.py ZoomEventCollector_test.py ZoomEventCollector.yml ZoomEventCollector_description.md

Download History Raw

## Zoom Event Collector
Use this integration to collect operation logs and activity reports automatically from Zoom.
You can also use the ***zoom-get-events*** command to manually collect events.

In order to use this integration, you need to enter your Zoom credentials in the relevant integration instance parameters.

Log in to your Zoom admin user account, and follow these steps:
Click [here](https://marketplace.zoom.us/develop/create) to create an app.
### For the OAuth method:
- Enable permissions.
- Create an Server-to-Server OAuth app.
- Add relevant scopes: report:read:admin
- With your Admin user navigate to User Management > Roles. In the role associated with the installed user, navigate to **Reports** and enable view access to the following :
    - **Admin Activity Logs**
    - **Sign In/Sign Out**
- Use the following account credentials to get an access token:
    Account ID
    Client ID
    Client secret

For more information about creating an OAuth app click [here](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app/).

### Rate Limits
The API requests in the integration are heavy rate limits. 
Rate limits are applied based on the account plan: Free, Pro, and Business+. For more information, see: [Rate limits by account type](https://developers.zoom.us/docs/api/rest/rate-limits/#rate-limits-by-account-type).