|
| 1 | +--- |
| 2 | +id: jumpcloud-directory-insights |
| 3 | +title: JumpCloud Directory Insights |
| 4 | +sidebar_label: Jumpcloud Directory Insights |
| 5 | +description: The Sumo Logic app for JumpCloud Directory Insights provides a comprehensive visibility into authentication events, user activities, and security-related actions within your JumpCloud-managed environment. |
| 6 | +--- |
| 7 | + |
| 8 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 9 | + |
| 10 | +<img src={useBaseUrl('img/send-data/jumpcloud-directory-insights-logo.png')} alt="jumpcloud-directory-insights" width="100"/> |
| 11 | + |
| 12 | +The Sumo Logic App for JumpCloud Directory Insights helps IT admins and security analysts track user activities, authentication events, and security actions in JumpCloud-managed environment. By using JumpCloud Directory Insights logs, the app allows them to monitor access, detect anomalies, and respond to security threats efficiently. |
| 13 | +With pre-configured dashboards, the app delivers insights into user authentication trends, directory modifications, policy enforcement, and security incidents. Analysts can track failed login attempts, privileged access changes, and account lockouts in real-time to improve security and ensure organizational policy compliance. |
| 14 | + |
| 15 | +:::info |
| 16 | +This app includes [built-in monitors](#jumpcloud-directory-insights-monitors). For details on creating custom monitors, refer to the [Create monitors for JumpCloud Directory Insights app](#create-monitors-for-the-jumpcloud-directory-insights-app). |
| 17 | +::: |
| 18 | + |
| 19 | +## Log types |
| 20 | + |
| 21 | +This app uses Sumo Logic’s [JumpCloud Directory Insights Source](docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jumpcloud-directory-insights-source/) to collect the logs from the JumpCloud Directory Insights platform. |
| 22 | + |
| 23 | +### Sample log messages |
| 24 | + |
| 25 | +<details> |
| 26 | +<summary>Event Log</summary> |
| 27 | + |
| 28 | +```json |
| 29 | +[ |
| 30 | + { |
| 31 | + "initiated_by": { |
| 32 | + "id": "64949312a2930fd2c93b2667", |
| 33 | + "type": "admin", |
| 34 | + |
| 35 | + }, |
| 36 | + "geoip": { |
| 37 | + "country_code": "US", |
| 38 | + "timezone": "America/Los_Angeles", |
| 39 | + "latitude": 37.7797, |
| 40 | + "continent_code": "NA", |
| 41 | + "region_name": "California", |
| 42 | + "longitude": -122.4159, |
| 43 | + "region_code": "CA" |
| 44 | + }, |
| 45 | + "resource": { |
| 46 | + "displayName": "Sumo Logic", |
| 47 | + "id": "64949312a2930fd2c93b2669", |
| 48 | + "type": "organization" |
| 49 | + }, |
| 50 | + "changes": [ |
| 51 | + { |
| 52 | + "field": "customer", |
| 53 | + "to": false |
| 54 | + }, |
| 55 | + { |
| 56 | + "field": "displayName", |
| 57 | + "to": "Sumo Logic" |
| 58 | + }, |
| 59 | + { |
| 60 | + "field": "features", |
| 61 | + "to": { |
| 62 | + "systemInsights": { |
| 63 | + "enableNewLinux": true, |
| 64 | + "enableNewWindows": true, |
| 65 | + "createdAt": "2023-06-22T18:29:38.966Z", |
| 66 | + "enableNewDarwin": true, |
| 67 | + "enabled": true, |
| 68 | + "updatedAt": "2023-06-22T18:29:38.966Z" |
| 69 | + }, |
| 70 | + "directoryInsightsPremium": { |
| 71 | + "createdAt": "2023-06-22T18:29:38.967Z", |
| 72 | + "enabled": false, |
| 73 | + "updatedAt": "2023-06-22T18:29:38.967Z" |
| 74 | + } |
| 75 | + } |
| 76 | + }, |
| 77 | + { |
| 78 | + "field": "id", |
| 79 | + "to": "64949312a2930fd2c93b2669" |
| 80 | + }, |
| 81 | + { |
| 82 | + "field": "logoUrl", |
| 83 | + "to": null |
| 84 | + }, |
| 85 | + { |
| 86 | + "field": "maxSystemUsers", |
| 87 | + "to": 10 |
| 88 | + }, |
| 89 | + { |
| 90 | + "field": "settings.contactEmail", |
| 91 | + |
| 92 | + }, |
| 93 | + { |
| 94 | + "field": "settings.contactName", |
| 95 | + "to": "Siri Oaklander" |
| 96 | + }, |
| 97 | + { |
| 98 | + "field": "settings.deviceIdentificationEnabled", |
| 99 | + "to": false |
| 100 | + }, |
| 101 | + { |
| 102 | + "field": "settings.disableGoogleLogin", |
| 103 | + "to": false |
| 104 | + }, |
| 105 | + { |
| 106 | + "field": "settings.enableManagedUID", |
| 107 | + "to": false |
| 108 | + }, |
| 109 | + { |
| 110 | + "field": "settings.enableUserPortalAgentInstall", |
| 111 | + "to": false |
| 112 | + }, |
| 113 | + { |
| 114 | + "field": "settings.name", |
| 115 | + "to": "Sumo Logic" |
| 116 | + }, |
| 117 | + { |
| 118 | + "field": "settings.newSystemUserStateDefaults", |
| 119 | + "to": { |
| 120 | + "applicationImport": "STAGED", |
| 121 | + "manualEntry": "STAGED", |
| 122 | + "csvImport": "STAGED" |
| 123 | + } |
| 124 | + }, |
| 125 | + { |
| 126 | + "field": "settings.passwordPolicy", |
| 127 | + "to": { |
| 128 | + "minLength": 8, |
| 129 | + "minChangePeriodInDays": 0, |
| 130 | + "enableResetLockoutCounter": false, |
| 131 | + "enablePasswordExpirationInDays": false, |
| 132 | + "enableMaxHistory": false, |
| 133 | + "enableDaysAfterExpirationToSelfRecover": true, |
| 134 | + "enableMaxLoginAttempts": true, |
| 135 | + "needsSymbolic": true, |
| 136 | + "daysAfterExpirationToSelfRecover": -1, |
| 137 | + "needsNumeric": true, |
| 138 | + "needsUppercase": true, |
| 139 | + "enableMinLength": true, |
| 140 | + "enableRecoveryEmail": false, |
| 141 | + "resetLockoutCounterMinutes": 30, |
| 142 | + "allowUsernameSubstring": false, |
| 143 | + "maxHistory": 3, |
| 144 | + "maxLoginAttempts": 6, |
| 145 | + "passwordExpirationInDays": 90, |
| 146 | + "enableDaysBeforeExpirationToForceReset": false, |
| 147 | + "enableMinChangePeriodInDays": false, |
| 148 | + "needsLowercase": true, |
| 149 | + "lockoutTimeInSeconds": 600, |
| 150 | + "daysBeforeExpirationToForceReset": 10, |
| 151 | + "effectiveDate": "2023-06-22T14:27:14.338Z", |
| 152 | + "enableLockoutTimeInSeconds": true |
| 153 | + } |
| 154 | + }, |
| 155 | + { |
| 156 | + "field": "settings.systemUsersCanEdit", |
| 157 | + "to": true |
| 158 | + }, |
| 159 | + { |
| 160 | + "field": "settings.userPortal", |
| 161 | + "to": { |
| 162 | + "idleSessionDurationMinutes": 60 |
| 163 | + } |
| 164 | + } |
| 165 | + ], |
| 166 | + "useragent": { |
| 167 | + "os": "Mac OS X", |
| 168 | + "minor": "0", |
| 169 | + "os_minor": "15", |
| 170 | + "os_major": "10", |
| 171 | + "os_version": "10.15.7", |
| 172 | + "version": "112.0.0.0", |
| 173 | + "os_patch": "7", |
| 174 | + "patch": "0", |
| 175 | + "os_full": "Mac OS X 10.15.7", |
| 176 | + "major": "112", |
| 177 | + "name": "Chrome", |
| 178 | + "os_name": "Mac OS X", |
| 179 | + "device": "Mac" |
| 180 | + }, |
| 181 | + "auth_method": "other", |
| 182 | + "event_type": "organization_create", |
| 183 | + "service": "directory", |
| 184 | + "organization": "64949312a2930fd2c93b2669", |
| 185 | + "@version": "1", |
| 186 | + "client_ip": "23.118.110.219", |
| 187 | + "id": "64949312a2930fd2c93b266e", |
| 188 | + "timestamp": "2023-06-22T18:29:38.985Z" |
| 189 | + } |
| 190 | +] |
| 191 | +``` |
| 192 | +</details> |
| 193 | + |
| 194 | +### Sample queries |
| 195 | + |
| 196 | +```sql title="Top 10 Services" |
| 197 | +_sourceCategory="Labs/JumpCloud" |
| 198 | +| json "id", "timestamp", "service", "event_type", "client_ip", "success", "initiated_by.type", "auth_method", "useragent.os_full", "geoip.region_name", "resource.name" as id, event_time, service, event_type, ip, success, event_initiator, auth_method, device, region_name, resource_name nodrop |
| 199 | + |
| 200 | +// global filters |
| 201 | +| where service matches "{{service}}" |
| 202 | +| where event_type matches "{{event_type}}" |
| 203 | +| where region_name matches "{{region_name}}" OR isBlank(region_name) |
| 204 | + |
| 205 | +| where !isBlank(service) |
| 206 | +| count by id, service |
| 207 | +| count as frequency by service |
| 208 | +| sort by frequency, service |
| 209 | +| limit 10 |
| 210 | +``` |
| 211 | + |
| 212 | +## Collection configuration and app installation |
| 213 | + |
| 214 | +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; |
| 215 | + |
| 216 | +<CollectionConfiguration/> |
| 217 | + |
| 218 | +:::important |
| 219 | +Use the [Cloud-to-Cloud Integration for JumpCloud Directory Insights Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jumpcloud-directory-insights-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your JumpCloud Directory Insights app is properly integrated and configured to collect and analyze your JumpCloud Directory Insights data. |
| 220 | +::: |
| 221 | + |
| 222 | +### Create a new collector and install the app |
| 223 | + |
| 224 | +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; |
| 225 | + |
| 226 | +<AppCollectionOPtion1/> |
| 227 | + |
| 228 | +### Use an existing collector and install the app |
| 229 | + |
| 230 | +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; |
| 231 | + |
| 232 | +<AppCollectionOPtion2/> |
| 233 | + |
| 234 | +### Use an existing source and install the app |
| 235 | + |
| 236 | +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; |
| 237 | + |
| 238 | +<AppCollectionOPtion3/> |
| 239 | + |
| 240 | +## Viewing the JumpCloud Directory Insights dashboards |
| 241 | + |
| 242 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 243 | + |
| 244 | +<ViewDashboards/> |
| 245 | + |
| 246 | +### Overview |
| 247 | + |
| 248 | +The **JumpCloud Directory Insights - Overview** dashboard provides the following key metrics: |
| 249 | +- A comprehensive view of the directory activity (user logins, admin changes, system updates). |
| 250 | +- Tracking of successful and failed logins over time to help IT teams spot patterns. |
| 251 | +- Insights into user provisioning, deprovisioning, and group membership changes, with visibility into directory structure updates. |
| 252 | +- Monitoring of administrator actions like password resets and policy modifications.< br/> <img src={useBaseUrl(' https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/JumpCloud+Directory+Insights/JumpCloud+Directory+Insights+-+Overview.png')} alt="JumpCloud Directory Insights-Overview" style={{border: '1px solid gray'}} width="800" /> |
| 253 | + |
| 254 | +### Security Overview |
| 255 | + |
| 256 | +The **JumpCloud Directory Insights - Security Overview** dashboard provides the following key metrics: |
| 257 | +- Tracking of security events like failed logins, account lockouts, and privilege escalations. |
| 258 | +- Geographic insights into authentication activities to spot suspicious login locations. |
| 259 | +- Tracking of high-risk events such as MFA failures and unauthorized access attempts to enhance security monitoring. |
| 260 | +- Analysis of login behaviors and access trends to help security teams identify threats and enforce compliance policies.< br/> <img src={useBaseUrl(' https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/JumpCloud+Directory+Insights/JumpCloud+Directory+Insights+-+Security+Overview.png')} alt="JumpCloud Directory Insights-Security Overview" style={{border: '1px solid gray'}} width="800" /> |
| 261 | + |
| 262 | +## Create monitors for the JumpCloud Directory Insights app |
| 263 | + |
| 264 | +import CreateMonitors from '../../reuse/apps/create-monitors.md'; |
| 265 | + |
| 266 | +<CreateMonitors/> |
| 267 | + |
| 268 | +### JumpCloud Directory Insights monitors |
| 269 | + |
| 270 | +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |
| 271 | +|:--|:--|:--|:--| |
| 272 | +| `JumpCloud Directory Insights - Alerts Created` | This alert is triggered when potential security risks, configuration issues, or critical system events requiring investigation are identified. | Critical | Count > 3 | |
| 273 | +| `JumpCloud Directory Insights - Disabled MFA` | This alert is triggered when unauthorized flags or accidental removal of MFA, which could expose accounts to compromise, are identified. Immediate review is recommended to ensure compliance and security. | Critical | Count > 0 | |
| 274 | +| `JumpCloud Directory Insights - Events from Embargoed Locations` | This alert is triggered when logins or actions from embargoed locations, suggesting potential unauthorized access, are detected. Investigate to confirm legitimacy or block malicious actors. | Critical | Count > 0 | |
| 275 | +| `JumpCloud Directory Insights - Impossible Logins` | This alert is triggered when the user account is compromised. For example, a user logging in from two distant locations consecutively. Urgent investigation is required to rule out credential theft. | Critical | Count > 0 | |
| 276 | +| `JumpCloud Directory Insights - Unsuccessful Logins` | This alert is triggered when credentials are misconfigured, or when brute-force attacks and credential stuffing are detected. Review source IPs and lock accounts if suspicious activity is confirmed. | Critical | Count > 1 | |
| 277 | +| `JumpCloud Directory Insights - Unsuccessful SSOs` | This alert is triggered by misconfigurations in identity providers or malicious attempts to bypass SSO. Check SSO logs to identify the cause or any threats. | Critical | Count > 1 | |
| 278 | + |
| 279 | +## Upgrade/Downgrade the JumpCloud Directory Insights app (Optional) |
| 280 | + |
| 281 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 282 | + |
| 283 | +<AppUpdate/> |
| 284 | + |
| 285 | +## Uninstalling the JumpCloud Directory Insights app (Optional) |
| 286 | + |
| 287 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 288 | + |
| 289 | +<AppUninstall/> |
0 commit comments