|
1 | 1 | --- |
2 | 2 | id: auth0 |
3 | | -title: Auth0 - Cloud SIEM |
4 | | -sidebar_label: Auth0 system parser |
| 3 | +title: Ingest Auth0 Data into Cloud SIEM |
| 4 | +sidebar_label: Auth0 |
5 | 5 | description: Configure an HTTP source to ingest Auth0 log messages and send them to Cloud SIEM’s Auth0 system parser. |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | import useBaseUrl from '@docusaurus/useBaseUrl'; |
9 | 9 |
|
10 | | -## Step 1: Configure collection |
11 | | - |
12 | | -In this step, you configure an HTTP Source to collect Auth0 log messages. You can configure the source on an existing Hosted Collector or create a new collector. If you’re going to use an existing collector, jump to [Configure an HTTP Source](#configure-an-http-source) below. Otherwise, create a new collector as described in [Configure a Hosted Collector](#configure-a-hosted-collector) below, and then create the HTTP Source on the collector. |
13 | | - |
14 | | -### Configure a Hosted Collector |
15 | | - |
16 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
17 | | -1. Click **Add Collector**. |
18 | | -1. Click **Hosted Collector.** |
19 | | -1. The **Add Hosted Collector ** popup appears.< br/><img src={useBaseUrl('img/cse/add-hosted-collector.png')} alt="Add hosted image collector" style={{border: '1px solid gray'}} width="500" /> |
20 | | -1. **Name**. Provide a Name for the Collector. |
21 | | -1. **Description**. (Optional) |
22 | | -1. **Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. |
23 | | -1. **Fields**. |
24 | | - 1. If you are planning that all the sources you add to this collector will forward log messages to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will cause the collector to forward all of the logs collected by all of the sources on the collector to Cloud SIEM. |
25 | | - 1. If all sources in this collector will be Auth0 sources, add an additional field with key `_parser` and value */Parsers/System/Auth0/Auth0*. |
26 | | - |
27 | | -:::note |
28 | | -It’s also possible to configure individual sources to forward to Cloud SIEM, as described in the following section. |
29 | | -::: |
30 | | - |
31 | | -### Configure an HTTP Source |
32 | | - |
33 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
34 | | -1. Navigate to the Hosted Collector where you want to create the source. |
35 | | -1. On the **Collectors** page, click **Add Source** next to a Hosted Collector. |
36 | | -1. Select **HTTP Logs & Metrics**. |
37 | | -1. The page refreshes.< br/><img src={useBaseUrl('img/cse/http-source.png')} alt="HTTP source" style={{border: '1px solid gray'}} width="600" /> |
38 | | -1. **Name**. Enter a name for the source. |
39 | | -1. **Description**. (Optional) |
40 | | -1. **Source Host.** (Optional) Enter a string to tag the messages collected from the source. The string that you supply will be saved in a metadata field called `_sourceHost.` |
41 | | -1. **Source Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. |
42 | | -1. **SIEM Processing**. Click the checkbox to configure the source to forward log messages to Cloud SIEM. |
43 | | -1. **Fields.** If you are not parsing all sources in the hosted collector with the same parser, click the **+Add Field** link, and add a field whose name is `_parser` with value */Parsers/System/Auth0/Auth0*. |
44 | | -12. **Advanced Options for Logs**. For information about the optional advance options you can configure, see [HTTP Logs and Metrics Source](/docs/send-data/hosted-collectors/http-source/logs-metrics/). |
45 | | -13. Click **Save**. |
46 | | -14. Make a note of the HTTP Source URL that is displayed. You’ll supply it in Step 2 below. |
47 | | - |
48 | | -## Step 2: Configure Auth0 |
49 | | - |
50 | | -In this step you configure Auth0 to send log messages to the Sumo Logic platform. For instructions, see [Stream Logs to Sumo Logic](https://auth0.com/docs/logs/streams/stream-logs-to-sumo-logic) |
51 | | -in Auth0 help. |
52 | | - |
53 | | -## Step 3: Verify ingestion |
54 | | - |
55 | | -In this step, you verify that your logs are successfully making it into |
56 | | -Cloud SIEM. |
57 | | - |
58 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
59 | | -1. On the **Log Mappings ** tab search for Auth0 and check the **Records ** columns.< br/><img src={useBaseUrl('img/cse/auth0-reocrd-volume.png')} alt="Record volume" style={{border: '1px solid gray'}} style={{border: '1px solid gray'}} width="800" /> |
60 | | -1. For a more granular look at the incoming records, you can also use the Sumo Logic platform to search for Auth0 security records.< br/><img src={useBaseUrl('img/cse/auth0-search.png')} alt="Auth0 search" style={{border: '1px solid gray'}} style={{border: '1px solid gray'}} width="500" /> |
| 10 | +To ingest Auth0 data into Cloud SIEM: |
| 11 | +1. [Configure a source for Auth0](/docs/integrations/saml/auth0/#configure-a-source) on a collector. When you configure the source, do the following: |
| 12 | + 1. Select the **Forward to SIEM** option in the source configuration UI. This will ensure all logs for this source are forwarded to Cloud SIEM. |
| 13 | + 1. Click the **+Add** link to add a field whose name is `_parser` with value */Parsers/System/Auth0/Auth0*. This ensures that the Auth0 logs are parsed and normalized into structured records in Cloud SIEM. |
| 14 | +1. Configure Auth0 to send log messages to the Sumo Logic platform. For instructions, see [Sumo Logic](https://marketplace.auth0.com/integrations/sumo-logic-log-streaming) in the Auth0 help. |
| 15 | +1. To verify that your logs are successfully making it into Cloud SIEM: |
| 16 | + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
| 17 | + 1. On the **Log Mappings ** tab search for Auth0 and check the **Records ** columns.< br/><img src={useBaseUrl('img/cse/auth0-reocrd-volume.png')} alt="Record volume" style={{border: '1px solid gray'}} style={{border: '1px solid gray'}} width="800" /> |
| 18 | + 1. For a more granular look at the incoming records, you can also use the Sumo Logic platform to search for Auth0 security records: <br/>`_index=sec_record* and metadata_product = "Auth0"` |
0 commit comments