Integrating OneTrust User Login History with External SIEM Tools

You can configure an integration to pass user login activity from the OneTrust Platform to external systems such as your Security Information and Event Management (SIEM) tools. Authentication events are published for successful user login events and includes relevant context such as user information, browser and device details, and IP address. Configuring this integration provides you with the ability to send successful login events to your configured SIEM tools and gain visibility into authentication activity to support centralized security monitoring.

Note:

This integration only sends successful login events to SIEM tools. Failed login events are currently not supported.

To send login events to Splunk

You can send login events using the out-of-the-box Splunk connector available within the Integrations gallery.

  1. On the Integrations menu, select Gallery. The Integrations gallery screen appears.


  2. Enter Splunk in the Search field, and select the Splunk tile. The Gallery details screen appears.


  3. Click the Add button on the Splunk: Login Events tile. The Integration wizard screen appears.


  4. (Optional) On the Configure trigger step, complete the conditions block to define when login events are sent to Splunk, if needed. Then click the Next button.


  5. On the Host configuration step, provide Splunk configuration details by entering the Splunk Host URL to specify the destination for login event data. Then click the Next button.


  6. On the Integration summary step, review the configuration details. Click the Save button to create the integration. You can then test and activate your integration when ready.


To send login events to external SIEM tool

You can send login events to your desired SIEM tool by creating a generic integration workflow.

  1. On the Integrations menu, select Integrations. The Integrations screen appears.

  2. Click the Add integration button. The Add Integration modal appears.


    Field
    Description
    Integration name

    Enter a name for the integration.

    Description(Optional)

    Enter a description for the integration.

    System

    Select your SIEM tool to which you want to send login events.

    Notification email

    Enter a valid email address to which notifications will be sent.

  3. Click the Add button. The Integration builder screen appears.


  4. Select Identity Access and click Login Event to configure the OneTrust trigger from which the integration should launch.


  5. (Optional) Complete the conditions block that appears to define when login events are sent, if needed. Then click the Done button.
  6. Click the Add action button and select the POST action to send login events from the OneTrust Platform to your SIEM tool. Then select your credentials, and click the Next button.
  7. In the Request URL field, specify the required endpoint for your SIEM tool and complete the remaining fields as necessary. Then click the Finish button.


  8. Click the Save button. You can then test and activate your integration when ready.

    For more information, see Managing Custom Integrations.



User Login Event Sample Payloads

The following sample payloads show the data that is sent for user login event integrations.

Splunk: Login Events Payload

JSON 
{
  "event": {
    "eventId": "d358d985-9dfb-4abe-862d-6ef7fd7bada3",
    "eventType": "19000",
    "timestamp": "2026-04-24T17:07:41.943264979Z",
    "userId": "7611f2d4-d841-48cb-aecd-207d8e23d977",
    "userEmail": "cbraden@gilberthughes.com",
    "sessionId": "c6b91f0a-eca1-4035-9b57-dc87623181d8",
    "status": "SUCCESS",
    "loginType": "SAML",
    "ipAddress": "165.85.153.19",
    "browser": "Chrome",
    "browserVersion": "147.0.0.0",
    "platform": "macOS",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
    "tenantName": "Gilbert Hughes & Company",
    "tenantGuid": "48451265-cb3a-42e6-af35-d65904cfa536",
    "category": "AUTHENTICATION",
    "action": "LOGIN_SUCCESS_SAML"
  },
  "sourcetype": "onetrust:login:event",
  "source": "onetrust-integration-manager",
  "host": "onetrust"
}

Generic Integration: Login Event Payload

JSON 
{
  "eventId": "71555825-03f7-4cde-a332-3dd585e93c47",
  "eventTime": "2026-04-24T17:07:42.052+00:00",
  "eventType": "19000",
  "payload": {
    "eventId": "d358d985-9dfb-4abe-862d-6ef7fd7bada3",
    "eventType": "LOGIN_EVENT",
    "eventTimestamp": "2026-04-24T17:07:41.943264979Z",
    "userId": "7611f2d4-d841-48cb-aecd-207d8e23d977",
    "userEmail": "cbraden@gilberthughes.com",
    "sessionId": "c6b91f0a-eca1-4035-9b57-dc87623181d8",
    "status": "SUCCESS",
    "loginType": "SAML",
    "ipAddress": "165.85.153.19",
    "browser": "Chrome",
    "browserVersion": "147.0.0.0",
    "platform": "macOS",
    "userAgentString": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
    "tenantName": "Gilbert Hughes & Company",
    "tenantGuid": "48451265-cb3a-42e6-af35-d65904cfa536",
    "severity": "INFO",
    "category": "AUTHENTICATION",
    "action": "LOGIN_SUCCESS_SAML"
  },
}