IDP Logs - SIEM

[Domingues, Michael D]

This should be a good starting point: https://wiki.shibboleth.net/confluence/display/IDP30/AuditLoggingConfiguration


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Vipin Jain <vjain at simeiosolutions.com>
Sent: Thursday, July 27, 2017 12:43:37 PM
To: Shib Users
Subject: Re: IDP Logs - SIEM

Thanks Scott.

Can you please let us know which document link you are referring and which log file does all info has which I need.

Sent from my phone

On 27 Jul 2017 10:36 pm, "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
On 7/27/17, 1:03 PM, "users on behalf of Vipin Jain" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of vjain at simeiosolutions.com<mailto:vjain at simeiosolutions.com>> wrote:

> How can I get user attributes in logs which my SIEM tool can learn.

There is no built-in audit field that contains the values, only the names of the attributes. If you want actual attribute data in the log you would have to supply a custom field extraction function per the documentation.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

The information in this message may contain confidential information and may be legally privileged. It is intended solely for the individual(s) named. Access to this email by anyone else is unauthorized. Please notify the sender immediately if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Email transmission cannot be guaranteed to be secure or error-free, as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. When addressed to our clients any decisions or recommendations contained in this email are subject to the terms and conditions expressed our contract and related statement of work letter(s)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170727/54c3f867/attachment.html>