Skip to main content

Login Events

Sync Type: Incremental

Overview​

The Oracle Login Events input collects sign-in and sign-out audit events from Oracle Access Management (OAM), providing visibility into user authentication activities across your Oracle Cloud environment. This integration captures detailed login events including authentication attempts, session activity, user identification, IP addresses, and access timestamps.

Prerequisites​

1. Oracle Cloud Account​

You must have access to an Oracle Cloud Account with appropriate permissions to access the Oracle Access Management REST API and retrieve audit events.

Important Security Note: Audit events contain sensitive authentication data including user login attempts, IP addresses, and session information. Ensure proper access controls are in place when configuring this integration and follow the principle of least privilege when creating service credentials.

Configuration​

Settings​

SettingTypeRequiredDescription
Domain NamestringtrueThe domain name for your Oracle Cloud service (e.g., acmeco.fa.us2.oraclecloud.com).
UsernamestringtrueOracle Cloud service user
Backfill Start TimestringNoThe date to start fetching data from. If not specified, no past records will be fetched.

Secrets​

SecretTypeRequiredDescription
PasswordstringtruePassword for the Oracle Cloud user

Authentication​

This integration uses HTTP Basic Authentication with the Oracle Access Management REST API:

  • Username: Oracle Cloud service user
  • Password: User password

The credentials are automatically encoded and sent in the Authorization header as Basic <base64-encoded-credentials>.

Data Collection​

  • Login events are collected incrementally based on the accessTime timestamp.
  • Events include sign-in attempts, sign-out events, authentication successes, and authentication failures.
  • Each event contains user identification, IP address, status, and Oracle-specific identifiers.

Sample Record​

{
    "accessTime": "2025-11-26T18:04:05.305263Z",
    "attributeMap": {
        "attribute": {
            "key": "sessionId",
            "value": "WebClient"
        }
    },
    "eventID": "1174",
    "ipAddress": "90.24.46.225",
    "oracleECID": "3ed92cb6-9703-24db-f5a6-5d49ea40c3b9",
    "status": "SUCCESS",
    "type": "SessionCreated",
    "userID": {
        "loginID": "PeterMiller@example.com",
        "loginType": "",
        "userDN": "cn=Peter Miller,ou=users,dc=example,dc=com",
        "userGUID": ""
    }
}