You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We're excited to introduce the new **OneLogin - User Inventory** dashboard to the existing OneLogin app for Sumo Logic. This dashboard offers a centralized view of user account lifecycle and activity within the OneLogin environment. [Learn more](/docs/integrations/saml/onelogin/#user-inventory).
@@ -11,8 +11,16 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
11
11
12
12
OneLogin is an Identity Management provider that supplies a comprehensive set of enterprise-grade identity and access management solutions, including single sign-on (SSO), user provisioning, and multi-factor authentication (MFA). The Sumo Logic app for OneLogin provides real-time visibility and analysis of OneLogin user activity through event data, such as user logins, administrative operations, and provisioning.
13
13
14
+
The app provides insights into account activity and user behavior, including total and invited users, inactive or never-logged-in accounts, user status, failed login attempts, lockouts, and password reset needs, helping administrators monitor user lifecycles and maintain security.
15
+
16
+
:::info
17
+
This app includes [built-in monitors](#onelogin-alerts). For details on creating custom monitors, refer to [Create monitors for OneLogin app](#create-monitors-for-onelogin-app).
18
+
:::
19
+
14
20
## Prerequisites
15
21
22
+
### Configure an event broadcaster for event logs
23
+
16
24
:::note
17
25
To use this feature, you'll need to enable access to your OneLogin logs and ingest them into Sumo Logic.
18
26
:::
@@ -24,106 +32,88 @@ Once you begin uploading data, your daily data usage will increase. It's a good
24
32
* Add a Sumo Logic [Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector) to your Sumo Logic Org.
25
33
* Configure an [HTTP Source](/docs/send-data/hosted-collectors/http-source/logs-metrics) for your OneLogin data. Make sure to set the **Source Category** when configuring the OneLogin source. For example, onelogin.
26
34
* From OneLogin, configure a broadcaster that points to this endpoint using the instructions in the [OneLogin documentation](https://onelogin.service-now.com/support?id=kb_article&sys_id=43f95543db109700d5505eea4b961959). You must use SIEM (NDJSON) format. Use the Sumo Logic HTTP Source URL as the Listener URL, and custom header is not needed.
35
+
***Configure the C2C source for users' logs**
36
+
* Follow the instructions for setting up [Cloud-to-Cloud Integration for OneLogin App](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/onelogin-source/) to create the source and use the same source category while installing the app.
27
37
28
38
## Log types
29
39
30
-
The Sumo Logic app for OneLogin uses event logs in NDJSON format.
40
+
The Sumo Logic app for OneLogin uses the following logs:
41
+
- Event logs in NDJSON format.
42
+
- Sumo Logic’s [OneLogin Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/onelogin-source/) to collect [Users' Logs](https://developers.onelogin.com/api-docs/2/users/user-resource) from OneLogin platform.
31
43
32
44
## Sample log messages
33
45
34
-
Each event is a single-line JSON, containing information such as:
| if (state =0, "Unapproved", if (state =1, "Approved", if (state =2, "Rejected", if (state =3, "Unlicensed", "Other")))) as state
80
+
| if (status =0, "Unactivated", if (status =1, "Active", if (status =2, "Suspended", if (status =3, "Locked", if (status =4, "Password expired", if (status =5, "Awaiting password reset", if (status =7, "Password pending", if (status =8, "Security questions required", "Other")))))))) as status
81
+
82
+
| first(state) as state, first(status) as status by id, user_name
83
+
| where state matches "{{state}}"
84
+
| where status matches "{{status}}"
85
+
| where user_name matches "{{user_name}}"
86
+
87
+
| count by state, id
88
+
| count by state
89
+
| sort by _count, state
120
90
```
121
91
122
92
## Installing the OneLogin app
123
93
124
-
import AppInstall from '../../reuse/apps/app-install-v2.md';
125
-
126
-
<AppInstall/>
94
+
To install the app, do the following:
95
+
:::note
96
+
Next-Gen App: To install or update the app, you must be an account administrator or a user with Manage Apps, Manage Monitors, Manage Fields, Manage Metric Rules, and Manage Collectors capabilities depending upon the different content types part of the app.
97
+
:::
98
+
1. Select **App Catalog**.
99
+
1. In the 🔎 **Search Apps** field, run a search for your desired app, then select it.
100
+
1. Click **Install App**.
101
+
:::note
102
+
Sometimes this button says **Add Integration**.
103
+
:::
104
+
1. Click **Next** in the **Setup Data** section.
105
+
1. In the **Configure App** section of your respective app, complete the following field.
106
+
1. Enter values for two data sources:
107
+
- **Event logs data source**
108
+
- **User logs data source**
109
+
1. **Field Name**. If you already have collectors and sources set up, select the configured metadata field name (for example, `_sourcecategory`) or specify other custom metadata (for example, `_collector`) along with its metadata **Field Value**.
110
+
1. Click **Next**. You will be redirected to the **Preview & Done** section.
111
+
112
+
**Post-installation**
113
+
114
+
Once your app is installed, it will appear in your **Installed Apps** folder, and dashboard panels will start to fill automatically.
115
+
116
+
Each panel slowly fills with data matching the time range query received since the panel was created. Results will not immediately be available but will be updated with full graphs and charts over time.
127
117
128
118
## Viewing OneLogin dashboards
129
119
@@ -183,6 +173,32 @@ import FilterDashboards from '../../reuse/filter-dashboards.md';
The **OneLogin - User Inventory** dashboard offers a centralized view of user account lifecycle and activity within the OneLogin environment:
179
+
***Centralized user overview**. Provides a single view of user account lifecycle and activity within the OneLogin environment.
180
+
***Account provisioning metrics**. Tracks total users, invited users, never-logged-in accounts, pending approvals, and rejections.
181
+
***Risk detection**. Highlights issues like repeated failed logins, locked or inactive accounts, and password problems.
182
+
***Usage trends**. Visualizes user status and login activity to reveal patterns in user behavior.
183
+
***Security monitoring**. Includes detailed tables on lockouts, recent invites, and accounts with unchanged passwords.
184
+
***Governance and compliance support**. Helps ensure strong user management practices, risk awareness, and regulatory compliance.
185
+
186
+
<imgsrc='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/OneLogin/OneLogin+-+User+Inventory.png'alt="OneLogin - User Inventory dashboard" />
187
+
188
+
## Create monitors for OneLogin app
189
+
190
+
import CreateMonitors from '../../reuse/apps/create-monitors.md';
191
+
192
+
<CreateMonitors/>
193
+
194
+
### OneLogin alerts
195
+
196
+
| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition |
197
+
|:--|:--|:--|:--|
198
+
|`OneLogin - Account Lockout`| This alert is triggered when a user account has been locked due to multiple failed login attempts. | Critical | Count > 0 |
199
+
|`OneLogin - Password Expired & Reset Pending`| This alert is triggered when user accounts are found with expired passwords or are pending a password reset. | Critical | Count > 0 |
200
+
|`OneLogin - User Rejected`| This alert is triggered when a user account has been rejected, indicating denied access during onboarding or approval. | Critical | Count > 0 |
201
+
186
202
## Upgrade/Downgrade the OneLogin app (Optional)
187
203
188
204
import AppUpdate from '../../reuse/apps/app-update.md';
0 commit comments