OneLogin

​

Overview

The OneLogin integration uses the OneLogin Events API to ingest:

• User sign-in attempts and MFA outcomes
• App provisioning, role assignments, and access requests
• Policy and configuration changes
• Admin actions in the OneLogin portal

---

​

Prerequisites

• A OneLogin account with Account Owner or Administrator role.
• The region your OneLogin account is hosted in (us or eu).

---

​

Step 1: Create an API credential in OneLogin

1. Sign in to the OneLogin Admin portal.
2. Go to Developers → API Credentials.
3. Click New Credential.
4. Name it atatus-siem and choose the scope Read all (sufficient for log collection).
5. Click Save, then copy both the Client ID and Client Secret that are displayed.

---

​

Step 2: Connect OneLogin in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the OneLogin card and click Connect.
3. Fill in the form:

4. Click Connect.

---

​

Verification

• The OneLogin card shows Configured.
• Events with source onelogin appear in Security → Cloud SIEM → Audit Logs → Events within one poll cycle.