Overview

The OneLogin integration uses the OneLogin Events API to ingest:

  • User sign-in attempts and MFA outcomes
  • App provisioning, role assignments, and access requests
  • Policy and configuration changes
  • Admin actions in the OneLogin portal

Prerequisites

  • A OneLogin account with Account Owner or Administrator role.
  • The region your OneLogin account is hosted in (us or eu).

Step 1: Create an API credential in OneLogin

  1. Sign in to the OneLogin Admin portal.
  2. Go to Developers → API Credentials.
  3. Click New Credential.
  4. Name it atatus-siem and choose the scope Read all (sufficient for log collection).
  5. Click Save, then copy both the Client ID and Client Secret that are displayed.

Note: The Client Secret is shown only at creation. Store it securely before leaving the page.

Step 2: Connect OneLogin in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the OneLogin card and click Connect.
  3. Fill in the form:
Field Description Example
Client ID The Client ID generated in Step 1. 1234abcd...
Client Secret The matching Client Secret. ••••••••
Region OneLogin region for your tenant. us or eu
Poll Interval (minutes) How often to fetch new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The OneLogin card shows Configured.
  • Events with source onelogin appear in Security → Cloud SIEM → Audit Logs → Events within one poll cycle.