Install the Sumo Logic App
Now that you have set up collection for OneLogin, install the Sumo Logic App for OneLogin to use the preconfigured searches and Dashboards that provide insight into your data.
To install the app:
Locate and install the app you need from the App Catalog. If you want to see a preview of the dashboards included with the app before installing, click Preview Dashboards.
- From the App Catalog, search for and select the app.
- Select the version of the service you're using and click Add to Library.
- To install the app, complete the following fields.
- App Name. You can retain the existing name, or enter a name of your choice for the app.
- Data Source. Select either of these options for the data source.
- Choose Source Category, and select a source category from the list.
- Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. Example: (_sourceCategory=MyCategory).
- Advanced. Select the Location in Library (the default is the Personal folder in the library), or click New Folder to add a new folder.
- Click Add to Library.
Once an app is installed, it will appear in your Personal folder, or other folder that you specified. From here, you can share it with your organization.
Panels will start to fill automatically. It's important to note that each panel slowly fills with data matching the time range query and received since the panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps.
The Sumo Logic App for OneLogin helps you monitor the overall health of your OneLogin deployment. Dashboards keep an eye on errors being generated by back-end applications as well as errors generated from ELB instances. The OneLogin App offers three dashboards to help you track OneLogin events.
Visitor Locations. See the count and location of visitor IP addresses over the last 24 hours on the world map.
Events by App. See events from the last 24 hours by application name in a pie chart and compare app usage.
Logins by Country. See the count of number of logins by country name displayed in a table to get an idea of your visitor traffic by country in the last 24 hours.
Event Outlier Over Time. See the events that fall outside the normal range for the last 24 hours.
Failed Login Outlier. See any logins over the last 24 hours that fall outside the specified failed login threshold.
Successful Login Outlier. See any logins over the last 24 hours that fall outside the specified successful login threshold.
Top 10 Users by Events. View the top 10 users by number of events for the last 24 hours to identify heavy activity.
Event Distribution by App. See the percentage of events by application in the last 24 hours as a pie chart to identify the event distribution by apps having the most events recently.
Event Distribution by Event ID. See the percentage of each user action by Event ID for the last 24 hours as a pie chart to identify the apps having the most activity recently.
Logins by App. See the percentage of logins by application in the last 24 hours as a pie chart to identify the apps having the most events recently.
Top 10 Provisioning Errors and Warnings. See the top 10 provisioning error messages and warnings issued by OneLogin by count for the last 24 hours.
Failed Actions. See the error descriptions of failed actions and a count of the occurrence for the last 24 hours displayed in a table to identify possible issues.
User Activity. View the count of user activities by username as a bar chart for the last 24 hours as a bar chart to quickly identify unusual user activity.
Password Changes. See the count of password changes by username as a bar chart for the last 24 hours to quickly identify any unusually high numbers of password changes by a particular user.
Logins by Country. View the count of the logins by country in the last 24 hours to identify any unusual activity by country.
Users Created in Apps. See the number of users created in applications in the last 24 hours as a column chart. You can filter by app name to track the count of a particular app.
Assumed Users. View the details such as the timestamp, destination user, notes, source user, and count for the event when one user acted as another user in the last 24 hours.
Failed Logins. See the number of login failures by username in the last 24 hours on a bar chart to identify any unusual activity. You can filter by username as needed.
Successful Logins. See the number of successful logins by username in the last 24 hours to identify any unusual activity. You can filter by username as needed.
User Modifications. See user modifications by timestamp, destination user, source user, notes, and error description for the last 24 hours displayed in table. You can filter by time, user name, source user, or error description as needed to track unusual behavior.