With the looming threat and prevalence of complex cyber attacks on organizations, compliance standards and regulations are constantly tightening and evolving, which makes automation more important than ever. Whether you鈥檙e automating onboarding and offboarding, user access provisioning, policy rollouts, or full IT system reporting including data transfer to a third party, each automation lends itself to the end goal of compliance.
Although the requirements vary, a common thread among many compliance standards is the ability to control access to critical information based on identity. This is often done via least privilege access and group provisioning within a directory service or identity provider (IdP). As a part of this standard requirement, IT admins need to have a framework in place to prove that these controls exist and are working properly.
One common approach to this problem is the use of Security Information Event Management (SIEM) software to provide IT admins and auditors with enhanced insight into the activity logs from their IT environment.
Collecting Compliance Data with 黑料海角91入口
黑料海角91入口 Directory Platform is an all-in-one identity management platform that provides access control and device management capabilities from a single cloud admin portal. The Directory Insights鈩� service from 黑料海角91入口 provides comprehensive activity log data across all 黑料海角91入口-managed endpoints that can be ingested by SIEM software to serve organizations鈥� auditing and compliance needs. This data includes Windows, Mac, and Linux systems; RADIUS network authentications; LDAP access; SAML single sign-on (SSO) usage; and any changes admins make to end-users鈥� identities and authorization privileges.
This trail of events is a crucial step in passing an audit and complying with regulations like SOC 2, HIPAA, and PCI DSS.
Exporting Directory Insights For SIEMs
At 黑料海角91入口, we recognize that being able to prepare and collect data to be ingested by a SIEM solution is paramount for managing organizational security. To this end, we provide an AWS serverless app and API solution to facilitate data export for consumption by third party SIEM software.
AWS Serverless App
Directory Insights stores an organization鈥檚 event information for 90 days. For data storage outside of that window, we built an to migrate Directory Insights information into an organization鈥檚 AWS S3 bucket. The AWS serverless app is also a mechanism for extracting data and making it available for SIEM tools and other data analytics tools to pick up, as long as they鈥檙e set up properly.
To get started with this, you can enter your API key within the app, define your data collection interval, and click deploy. It’s that easy. We will automatically set up the infrastructure in your Amazon environment to poll the API and save the Directory Insights logs in a new S3 bucket, so you never miss a beat in your audit logs. There, your data will sit until the SIEM or log management tool you set up collects it for further analysis.
Setting up the serverless app automates the process of exporting data, and we recommend that every 黑料海角91入口 user set this up so the data is available right when it鈥檚 needed and manual processes don鈥檛 get in the way. Some 黑料海角91入口 customers collect large amounts of data about their environment and their users, so it鈥檚 incredibly helpful to have access to 黑料海角91入口 logs in context with all of the other information collected 鈥� this strategy provides the surface visibility needed to make quick decisions about the environment and its users.
API
黑料海角91入口 is built around a , allowing organizations to administer their directory service as they see fit outside of the limits of the Admin Portal interface. Our API allows users to access our Directory Insights logs and data about . There are two main types of data collected in 黑料海角91入口, and both are essential to understanding the entire picture of what goes on inside of your IT environment. Those two types of data are: events-based information which describes what happened and when and stateful information about what exists today.
To export this data so that a SIEM or other data analytics tool can pick it up, you can look for generic API connectors from your tool that allow you to ingest data from an API data source. With an admin API key, found in the 黑料海角91入口 Admin Portal, admins can poll the 黑料海角91入口 API for any information about the directory, identities, and devices.
Get Started with 黑料海角91入口 and Directory Insights
Use the 黑料海角91入口 Directory Platform and Directory Insights to manage user identities, devices, networks, and other IT resources while maintaining consistent event logging across each endpoint. Try out the platform today by .
