Integrating OneTrust Activity Logs with External SIEM Tools

You can configure an integration to pass activity records from the OneTrust Platform to external systems such as your Security Information and Event Management (SIEM) tools. These transactions are asynchronous, so events may not appear in real time. Filtering can be applied to only trigger the integration on certain conditions. Configuring this integration provides you with the ability to extract consistent logs of various activity events across objects throughout the platform to utilize within your SIEM services.

To send activity logs to external SIEM tool

  1. On the Integrations menu, select Integrations. The Integrations screen appears.
    Note:

    Alternatively, you can select Gallery to access the Integrations gallery screen, where you can create integrations using out-of-the-box SIEM connectors, such as Splunk, or select Generic to post to your desired SIEM tool.

  2. Click the Add integration button. The Add Integration modal appears.


    Field
    Description
    Integration name

    Enter a name for the integration.

    Description(Optional)

    Enter a description for the integration.

    System

    Select your SIEM tool to which you want to send activity logs.

    Notification email

    Enter a valid email address to which notifications will be sent.

  3. Click the Add button. The Integration builder screen appears.


  4. Select Activity Log and click Activity Record Created to configure the OneTrust trigger from which the integration should launch.


  5. Complete the conditions block that appears to apply filtering options in order to trigger the integration for a certain product, object, etc. Then click the Done button.
  6. Click the Add action button and select the POST action to send events from the OneTrust platform to your SIEM tools when the conditions are met. Then select your credentials, and click the Next button.
    Important:

    Although HTTP POST request URLs are the primary documented method for sending activity log data to external SIEM tools, the Workflow Builder supports multiple integration patterns. Depending on the use case, you can use generic actions, apply filtering and transformation logic before delivery, route events through reusable subflows, or leverage other supported integration targets and export mechanisms.

  7. In the Request URL field, specify the required endpoint for your SIEM tool and complete the remaining fields as necessary. Then click the Finish button.


  8. Click the Save button. You can then test and activate your integration when ready.

    For more information, see Managing Custom Integrations.

What types of logs are supported?

OneTrust supports passing the following types of activity logs from the OneTrust Platform to external systems such as your SIEM tools:

  • History of changes made to a user's profile, including events such as creating a user, editing a user's details, updating a user's roles, and deactivating a user

  • History of changes made to the organizational hierarchy, including events such as creating, updating, and deleting an organization and moving the organization within the hierarchy

  • History of changes made to user groups, including events such as adding a user group, updating or removing roles from the user group, and deleting a user group

  • Various activity events for objects across the platform, such as creating, updating, and deleting an audit