Device Integration: OneLogin

Table of Contents

• Overview
• Prerequisites
• Generate API Credentials in OneLogin
• Configuration Steps in ADR SIEM
• Verification (MSSP Only)

Overview

This guide explains how to integrate OneLogin with ADR/aiXDR using the OneLogin API.
Once configured, ADR’s CCE (Collection and Control Engine) will collect logs from OneLogin and forward them to the APE (Analytics and Policy Engine) for centralised visibility, threat detection, and compliance monitoring.

Prerequisites

• Administrative access to the OneLogin Admin Console.
• Administrative access to ADR SIEM UI.
• A running ADR CCE server with its IP address noted.

Generate API Credentials in OneLogin

1. Log in to the OneLogin Admin Console.
2. Navigate to Developers > API Credentials.
3. Click New Credential.
4. Enter a descriptive name (e.g., Aria-SIEM).
5. Select Scope: Read All.
6. Click Save and copy the Client ID and Client Secret.
7. Reference: OneLogin API Credentials Guide. OneLogin Developer Overview

Configuration Steps in ADR SIEM

1. Log in to the ADR SIEM UI with administrator rights.
2. Navigate to Administration > Add-on Store.
3. Search for OneLogin and click Add.
4. Fill in the details:

• Click Save to complete integration.

Verification (MSSP Only)

On ADR GUI Console

• Open the ADR GUI Console with the appropriate administrative rights user.
• Navigate to System Monitoring and drop down to System > Logs/Flows Collection Status.

  

  

• Verify that the OneLogin device appears under Source Device IP.

On ADR CCE CLI

1. SSH into the CCE server.
2. Run the following commands to verify the OneLogin add-on:

   otmdoc -s addondevice

3. Enter the add-on container and run:

   crontab -l

4. Copy the Python script path listed (e.g., python3 OneloginSecurity.py) and execute it to confirm log retrieval.