​
Overview

The Zoom integration uses the Zoom Reports API and Operation Logs API to ingest:
  • User sign-in attempts and SSO activity
  • Account, user, and group setting changes
  • Meeting and webinar configuration changes
  • App marketplace installations and authorizations

​
Prerequisites

  • A Zoom Pro, Business, Education, or Enterprise account.
  • Account Admin or Owner privileges to create a Server-to-Server OAuth app.

​
Step 1: Create a Server-to-Server OAuth app in Zoom

  1. Sign in to the Zoom App Marketplace at https://marketplace.zoom.us.
  2. Click Develop → Build App → Server-to-Server OAuth → Create.
  3. Name it Atatus SIEM.
  4. On the App Credentials page, copy the Account ID, Client ID, and Client Secret.
  5. On the Scopes page, add (read-only):
    • report:read:admin
    • user:read:admin
    • account:read:admin
  6. Activate the app.

​
Step 2: Connect Zoom in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Zoom card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The Zoom card shows Configured.
  • Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source zoom.