Idira

Idira: Polls the Idira audit API for identity security platform events, authenticating with OAuth2 client credentials.

Axoflow can collect data from your Idira deployment with an Axoflow Cloud Connector. At a high level, the process looks like this:

• Create a Connector Rule on the AxoRouter that deploys an Axoflow Cloud Connector and collects the data from Idira. Axoflow Cloud Connector is a simple container that runs on an AxoRouter instance.
• Configure a Flow on AxoConsole that processes and routes the collected data to your destination (for example, Splunk or another SIEM).

Prerequisites

• An AxoRouter instance that:

  • Was provisioned with Enable Cloudconnectors turned on.
  • Can reach the Idira audit API and the Identity Administration token endpoint on TCP port 443. Adjust your firewall rules and the access rules of the data source as needed.

  • You know the IP address the AxoRouter. To find it:

    1. Open the AxoConsole.
    2. Select the Routers or the Topology page.
    3. Select on AxoRouter instance that is going to receive the logs.
    4. Check the Networks > Address field.
• An Idira tenant with the SIEM integration enabled.
• The base URL of the Idira audit API, and a SIEM integration API key for it.
• An OAuth2 confidential client registered in Identity Administration, and the client ID and client secret of this client. The client must be allowed to request the isp.audit.events:read scope.

Configure Axoflow Cloud Connector on AxoRouter

To collect data from Idira, complete the following steps.

1. Select Routers > Connector Rules > Add Connector Rule. (Alternatively, you can select Add Connector > Add a connector rule on the Connectors page of an AxoRouter host.)

   

2. Select Idira.

3. Enter a name for the connector rule into the Connector rule name field.

   

4. (Optional) Add labels to the connector rule. You will be able to use these labels in Flow Processing steps, for example, in the Query field of Select Messages steps. For details about the message schema and the related connector-specific fields, see the meta.connector object.

5. Set the Router selector for the connector rule. The selector determines which AxoRouter instances get a connector from this connector rule.

   CAUTION:

   Each connector rule for Idira must match exactly one AxoRouter. Use the name or guid AQL selector to make sure it matches only one AxoRouter. Otherwise several Axoflow Cloud Connector instances collect the same data, and Axoflow receives every message multiple times.

   

   You can use any labels and metadata of the AxoRouter hosts in the Router selectors, for example, the hostname of the AxoRouter, or any custom labels.

   • If you leave the router selector empty, it matches every AxoRouter instance.
   • To select only a specific AxoRouter instance, set the name field to the name of the instance as selector. For example, name = my-axorouter.
   • If you set multiple fields in the selector, the selector will match only AxoRouter instances that match all elements of the selector. (There in an AND relationship between the fields.)

6. (Optional) Enter a Suffix for the connector rule. AxoConsole uses the suffix in the name of the connector instances that it creates on the AxoRouter hosts. The name of the connector instance follows the <name-of-AxoRouter>-<suffix> schema. For example, if the name of a matching AxoRouter instance is axorouter-1, and the suffix of the rule is custom, the name of the connector on that AxoRouter is axorouter-1-custom.

   If the Suffix field is empty, AxoConsole uses the name of the connector rule instead. For example, if the name of the connector rule is otlp-1, the name of the connector is axorouter-1-otlp-1.

7. (Optional) Enter a description for the rule.

8. Configure how Axoflow Cloud Connector reaches the Idira audit API.

   • Endpoint: The base URL of the Idira audit API.
   • API key: The SIEM integration API key. Axoflow Cloud Connector sends it in the x-api-key header of every request.
   • Token URL: The OAuth2 token endpoint of Identity Administration, in the https://<identity_fqdn>/OAuth2/Token/<web_app_id> format.
   • Client ID and Client secret: The credentials of the OAuth2 confidential client that Axoflow Cloud Connector uses to obtain the access token.

9. (Optional) Select More options to change the advanced options of the connector, for example, how often it polls the API.

10. Select Add. The Axoflow Cloud Connector starts polling the Idira audit API and forwarding the collected events to the AxoRouter instance.

11. Verify that the Axoflow Cloud Connector is running.

    1. Select Routers, then select the AxoRouter you added the Axoflow Cloud Connector to.
    2. Select Services and check that axoflow-cloudconnector.service is running without errors.

12. Create a Flow to route the data from the AxoRouter instance to a destination. You can use the Labels of this source to select its messages.

Advanced options

Select More options on the connector rule to set the following options.

• Scopes: The OAuth2 scopes that Axoflow Cloud Connector requests for the access token. Default requests the isp.audit.events:read scope. Select Custom to request a different set of scopes. An empty custom list requests a token with no scopes at all.

• Poll interval: How often Axoflow Cloud Connector creates a new query. The Idira API accepts one query per minute, so Axoflow rejects shorter intervals. Default value: 1m

• Initial lookback: How far back the first poll queries when no checkpoint is stored yet. Set it to 0 to collect only the events that arrive after the connector starts. Default value: 5m

  Axoflow Cloud Connector checkpoints the position of the poll cursor, so after a restart it resumes the collection where the last poll stopped. The Initial lookback option applies only when there is no stored checkpoint.

• Page size: The number of events that Axoflow Cloud Connector fetches per results page. Minimum value: 1. Default value: 500

• Application codes: Restricts the query to the listed application codes. Leave it empty to collect the events of every application.

Labels

Axoflow automatically adds the following labels to data collected from this source:

You can use the labels as:

• labels in Customize Graph on the Analytics page,
• in the Filter labels field during log tapping.

You can use the message fields

• in Flow Processing steps, for example, in the Query field of Select Messages steps,
• in AQL expressions in the search bars.