---
title: "Idira"
url: "https://axoflow.com/docs/axoflow/data-sources/appliances/palo-alto/idira/"
description: "Collect data from Palo Alto Networks Idira with a Cloud Connector, and look up the labels Axoflow adds."
last_modified: "2026-10-01T12:33:43+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/llms.txt).

# Idira

Collect data from Palo Alto Networks Idira with a Cloud Connector, and look up the labels Axoflow adds.

Idira:
Polls the Idira audit API for identity security platform events, authenticating with OAuth2 client credentials.

Axoflow can collect data from your [Idira](https://www.paloaltonetworks.com/idira) deployment with an Axoflow Cloud Connector. At a high level, the process looks like this:

- [Create a **Connector Rule**](https://axoflow.com/docs/axoflow/data-sources/appliances/palo-alto/idira/index.md#create-connector-rule) on the AxoRouter that deploys an Axoflow Cloud Connector and collects the data from Idira. Axoflow Cloud Connector is a simple container that runs on an AxoRouter instance.
- Configure a [Flow](https://axoflow.com/docs/axoflow/data-management/index.md) on AxoConsole that processes and routes the collected data to your [destination](https://axoflow.com/docs/axoflow/destinations/index.md) (for example, Splunk or another SIEM).

![How Axoflow collects data from Idira with Axoflow Cloud Connector and AxoRouter](https://axoflow.com/docs/axoflow/data-sources/appliances/palo-alto/idira/architecture-same-host.svg)

## Prerequisites

- An AxoRouter instance that:

  - Was provisioned with [**Enable Cloudconnectors**](https://axoflow.com/docs/axoflow/provisioning/axorouter/linux/advanced-options/index.md#cloudconnectors-enable) turned on.
  - Can reach the Idira audit API and the Identity Administration token endpoint on TCP port 443. Adjust your firewall rules and the access rules of the data source as needed.
  - You know the IP address the AxoRouter. To find it:

    1. Open the AxoConsole.
    2. Select the **Routers** or the **Topology** page.
    3. Select on AxoRouter instance that is going to receive the logs.
    4. Check the **Networks > Address** field.
- An Idira tenant with the SIEM integration enabled.
- The base URL of the Idira audit API, and a SIEM integration API key for it.
- An OAuth2 confidential client registered in Identity Administration, and the client ID and client secret of this client. The client must be allowed to request the `isp.audit.events:read` scope.

## Configure Axoflow Cloud Connector on AxoRouter

To collect data from Idira, complete the following steps.

1. Select **Routers > Connector Rules > Add Connector Rule**. (Alternatively, you can select **Add Connector > Add a connector rule** on the **Connectors** page of an AxoRouter host.)

   ![Connector rules list](https://axoflow.com/docs/axoflow/img/data-management/connector-rules/connector-rules-list_hu_6f335a0660dd40e6.webp)
2. Select **Idira**.
3. Enter a name for the connector rule into the **Connector rule name** field.

   ![Generic connector rule parameters](https://axoflow.com/docs/axoflow/img/connector-rule-generic_hu_32a9c886e16162f3.webp)
4. (Optional) Add labels to the connector rule. You will be able to use these labels in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps. For details about the message schema and the related connector-specific fields, see the [`meta.connector` object](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.connector).
5. Set the **Router selector** for the connector rule. The selector determines which AxoRouter instances get a connector from this connector rule.

   **CAUTION:**

   Each connector rule for Idira must match exactly one AxoRouter. Use the `name` or `guid` AQL selector to make sure it matches only one AxoRouter. Otherwise several Axoflow Cloud Connector instances collect the same data, and Axoflow receives every message multiple times.

   ![Router selectors](https://axoflow.com/docs/axoflow/img/data-management/connector-rules/connector-rules-router-selector_hu_4e7807cc9a0d1c54.webp)

   You can use any labels and metadata of the AxoRouter hosts in the Router selectors, for example, the hostname of the AxoRouter, or any [custom labels](https://axoflow.com/docs/axoflow/onboard-hosts/hosts/add-host-metadata/index.md).

   - If you leave the router selector empty, it matches every AxoRouter instance.
   - To select only a specific AxoRouter instance, set the `name` field to the name of the instance as selector. For example, `name = my-axorouter`.
   - If you set multiple fields in the selector, the selector will match only AxoRouter instances that match all elements of the selector. (There in an AND relationship between the fields.)
6. (Optional) Enter a **Suffix** for the connector rule. AxoConsole uses the suffix in the name of the connector instances that it creates on the AxoRouter hosts. The name of the connector instance follows the `<name-of-AxoRouter>-<suffix>` schema. For example, if the name of a matching AxoRouter instance is `axorouter-1`, and the suffix of the rule is `custom`, the name of the connector on that AxoRouter is `axorouter-1-custom`.

   If the **Suffix** field is empty, AxoConsole uses the name of the connector rule instead. For example, if the name of the connector rule is `otlp-1`, the name of the connector is `axorouter-1-otlp-1`.
7. (Optional) Enter a description for the rule.
8. Configure how Axoflow Cloud Connector reaches the Idira audit API.

   - **Endpoint**: The base URL of the Idira audit API.
   - **API key**: The SIEM integration API key. Axoflow Cloud Connector sends it in the `x-api-key` header of every request.
   - **Token URL**: The OAuth2 token endpoint of Identity Administration, in the `https://<identity_fqdn>/OAuth2/Token/<web_app_id>` format.
   - **Client ID** and **Client secret**: The credentials of the OAuth2 confidential client that Axoflow Cloud Connector uses to obtain the access token.
9. (Optional) Select **More options** to change the [advanced options](https://axoflow.com/docs/axoflow/data-sources/appliances/palo-alto/idira/index.md#advanced-options) of the connector, for example, how often it polls the API.
10. Select **Add**. The Axoflow Cloud Connector starts polling the Idira audit API and forwarding the collected events to the AxoRouter instance.
11. Verify that the Axoflow Cloud Connector is running.

    1. Select **Routers**, then select the AxoRouter you added the Axoflow Cloud Connector to.
    2. Select **Services** and check that **axoflow-cloudconnector.service** is running without errors.
12. [Create a Flow](https://axoflow.com/docs/axoflow/data-management/flows/index.md) to route the data from the AxoRouter instance to a destination. You can use the [Labels](https://axoflow.com/docs/axoflow/data-sources/appliances/palo-alto/idira/index.md#labels) of this source to select its messages.

## Advanced options

Select **More options** on the connector rule to set the following options.

- **Scopes**: The OAuth2 scopes that Axoflow Cloud Connector requests for the access token. **Default** requests the `isp.audit.events:read` scope. Select **Custom** to request a different set of scopes. An empty custom list requests a token with no scopes at all.
- **Poll interval**: How often Axoflow Cloud Connector creates a new query. The Idira API accepts one query per minute, so Axoflow rejects shorter intervals. Default value: `1m`
- **Initial lookback**: How far back the first poll queries when no checkpoint is stored yet. Set it to `0` to collect only the events that arrive after the connector starts. Default value: `5m`

  Axoflow Cloud Connector checkpoints the position of the poll cursor, so after a restart it resumes the collection where the last poll stopped. The **Initial lookback** option applies only when there is no stored checkpoint.
- **Page size**: The number of events that Axoflow Cloud Connector fetches per results page. Minimum value: `1`. Default value: `500`
- **Application codes**: Restricts the query to the listed application codes. Leave it empty to collect the events of every application.

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | Value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.vendor) | `idira` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.product) | `idira` |

You can use the labels as:

- labels in **Customize Graph** on the [Analytics page](https://axoflow.com/docs/axoflow/metrics/analytics/index.md),
- in the **Filter labels** field during [log tapping](https://axoflow.com/docs/axoflow/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.