• Home
• App Integrations
• SIEM Integration

SIEM Integration with miniOrange

---

Integrate miniOrange with your Security Information and Event Management (SIEM) platform to collect and forward IAM, SSO, MFA, authentication, and security audit logs for centralized monitoring and analysis. SIEM integration allows security teams to capture and deliver identity-related events to cloud-based or on-premise SIEM platforms in near real time.

miniOrange supports SIEM integrations with platforms such as Splunk, Sumo Logic, and FortiSIEM. You can control the security data sent to your SIEM through:

• Event filtering: Filter the security events forwarded to your SIEM based on your security configuration and policies, so you can focus on relevant events.
• Data retention: The miniOrange Collector retains security event data for up to 12 hours, allowing you to retrieve events that may have been missed during temporary connectivity issues.

How SIEM Integration Works

SIEM integration collects security and audit events generated by the miniOrange Identity Platform and forwards them to your SIEM for centralized monitoring and analysis.

miniOrange supports two methods for SIEM log forwarding:

• TCP Forwarding: Forward security logs to a configured SIEM host and port using TCP. TLS encryption can be used to secure log transmission where supported.
• HTTP Forwarding: Send security event logs to the SIEM platform through its HTTP-based ingestion API or collector endpoint.

Which log formats do we support?

We currently support the JSON format.

JSON log event example

      
      {
  "audit": {
	"logId": "79804b38-3c70-11f0-ab78-06260491ad45",
	"customerId": 123456,
	"actor": {
  	"identifier": "a@gmail.com",
  	"type": "END_USER",
  	"displayName": "a d",
  	"customerId": 123456
	},
	"target": {
  	"identifier": "a@gmail.com",
  	"type": "END_USER",
  	"displayName": "a d",
  	"customerId":123456
	},
	"eventType": "Update Users Phone or Email.",
	"eventDescription": "User has updated Phone or Email.",
	"status": "SUCCESS",
	"displayMessage": "User has updated EMAIL.",
	"clientIp": "127.127.127.127"
  },
  "customerId": 123456,
  "auditKey": "Update Users Phone or Email.",
  "auditValue": "User with username: a@gmail.com has updated EMAIL to: b@gmail.com.",
  "xtraAttributes": "{}"
}
      
    

Follow the Step-by-Step Guide given below for SIEM Integration in Cloud & On-premise

1. SIEM Integration in Cloud

• Whitelist miniOrange Identity Cloud Server IPs in your SIEM Tool-
  

  Note: Contact miniOrange support to get the whitelisted miniOrange cloud server IPs.

• Share the Collector/Ingestion API URL of the SIEM Tool (if opting for HTTP Forwarding)
  For Example - https://collectors.fed.sumologic.com/receiver/v1/http/
• Share the Host and Port (if opting for TCP Forwarding).
  You might also be contacted for TLS credentials if required.

2. SIEM Integration in On-Premise

Prerequisites

We recommend changing the log level to error-level messages. When log levels are down to a minimum, the server generates large amounts of information in an active production environment. As an alternative, you can set the log level to ERROR and higher so that only important logs are logged. This ensures only important information is sent over to your SIEM tool.

You can even set up a specific log to log only ERROR and higher by modifying the log4j2.xml file. You can find log4j2.xml file here: <path to miniorange directory>\moas\WEB-INF\classes\log4j2.xml.

• Add an appender. The easiest way is to copy the one below.

      
        <Syslog name="Remote" host="<ip-address>" port="514" protocol="UDP">
            <PatternLayout pattern="${pattern}"/>
        </Syslog>
      
    



• Paste the appender in the appenders section as shown below. Make sure to replace <ip-address> with your SIEM IP Address.



• Add the following to any logger you may be interested in:

      
        <appender-ref ref="Remote" />
      
    



• For example:

      
        <asyncLogger name="com.miniorange" level="debug">
            <appender-ref ref="Remote" />
        </asyncLogger>
      
    



• Restart the server.

Frequently Asked Questions