Connect the OneLogin data source to
IBM Security QRadar® Suite Software to enable your applications and
dashboards to collect and analyze OneLogin
security data. Universal Data Insights connectors enable
federated search across your security products.
Before you begin
Collaborate with OneLogin administrator or
account owner to obtain an API credential pair: a Client Id and a
Client Secret with access to get the OneLogin events. For more information, see Working With API Credentials.
The OneLogin API operates in multiple regions
which are determined based on the domain name that is used. Use the domain for the region that your
OneLogin account resides in.
If you have a firewall between your cluster and the data source target, use the
IBM® Security Edge Gateway to host the containers. The Edge Gateway must be V1.6 or later. For more information,
see Edge Gateway.
About this task
QRadar Suite Software connector for OneLogin is designed to work with OneLogin using the events API endpoint, in which it uses
Query Parameters to filter the events.
Structured Threat Information eXpression (STIX) is a language and
serialization format that organizations use to exchange cyberthreat intelligence. The connector uses STIX patterning to query OneLogin data and returns results as STIX objects. For more information about how the
OneLogin data schema maps to STIX, see OneLogin
stix-shifter repository
(https://github.com/opencybersecurityalliance/stix-shifter/tree/develop/stix_shifter_modules/onelogin).
Procedure
- Log in to IBM Security QRadar Suite Software.
- From the menu, click
.
- On the Data Sources tab, click
Connect a data source.
- Click OneLogin, then click
Next.
- Configure the connection to allow
IBM Security QRadar Suite Software to connect to the data source.
- Configure the connection to the data source.
Table 1. Connection parameters
Parameter |
Description |
Data source name |
Enter a unique name to identify the data source connection. You can create multiple
connections to a data source, so it is useful to clearly set them apart by name. Only
alphanumeric characters and the following special characters are allowed: - .
_
|
Data source description |
Enter a description to indicate the purpose of the data source connection. You can create
multiple connections to a data source, so it is useful to clearly indicate the purpose of each
connection by description. Only alphanumeric characters and the following special characters are
allowed: - . _
|
Edge gateway |
If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the
Edge gateway field, specify an Edge Gateway to host the connector. It can take up to
five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.
|
Region |
Enter the region that your OneLogin
account is in. |
- Set the query parameters to control the behavior of the
federated search query on the data source.
Table 2. Query parameters
Query parameter |
Description |
Concurrent search limit |
Enter the number of simultaneous connections that can be made to the data source. The default
limit for the number of connections is 4. The value must not be less than 1 and must not be greater
than 100. |
Query search timeout limit |
Enter the time limit in minutes for how long the query is run on the data source. The default
time limit is 30. When the value is set to zero, no timeout occurs. The value must not be less than
1 and must not be greater than 120. |
Result size limit |
Enter the maximum number of entries or objects that are returned by search query. The default
result size limit is 10,000. The value must not be less than 1 and must not be greater than
500,000. |
Query time range |
Enter the time range in minutes for the search, represented as the last X
minutes. The default is 5 minutes. The value must not be less than 1 and must not be greater than
10,000. |
Custom mapping (Optional) |
If you need to customize the STIX attributes mapping, click
Customize attribute mapping and edit the JSON blob to map new or existing
properties to their associated target data source fields. |
Important: If you increase the Concurrent search limit and the
Result size limit, a greater amount of data can be sent to the data source,
which increases the strain on the data source. Increasing the query time range also increases the
amount of data.
- Click Add a
configuration.
- Configure identity and access.
Table 3. Configuration parameters
Parameter |
Description |
Configuration Name |
Enter a unique name to describe the access configuration and distinguish it from the other
access configurations for this data source connection that you might set up. Only alphanumeric
characters and the following special characters are allowed: - . _ |
Configuration Description |
Enter a unique description to describe the access configuration and distinguish it from the
other access configurations for this data source connection that you might set up. Only alphanumeric
characters and the following special characters are allowed: - . _ |
Client Id |
Enter the Client Id for your API credential pair. |
Client secret |
Enter the Client secret for your API credential pair. |
- Click Add.
- To save your configuration and establish the connection, click
Done.
- To edit your configurations, complete the following steps:
- On the Data Sources tab, select the data source connection that
you want to edit.
- In the Configurations section, click Edit
Configuration ().
- Edit the identity and access parameters and click
Save.
Results
You can see the data source connection configuration
that you added under Connections > Data Sources page.
Tip: After the data source is connected, it takes some time for the initial data
retrieval based on the frequency that is specified in the Frequency
parameter. During this time, the data source appears as unavailable. After the data retrieval is
complete, the data source shows as connected. To maintain the connection status, a polling mechanism
is initiated to verify the connection periodically.
What to do next
Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In
Data Explorer, click an IP address to view
its associated assets and risk.
To use Data Explorer,
you must have data sources that are connected so that the application can run queries and retrieve
results across a unified set of data sources. The search results vary depending on the data that is
contained in your configured data sources. For more information about how to build a query in
Data Explorer, see Build a query.