# Login Events
**Sync Type: Incremental**

## Overview
The Oracle Login Events input collects sign-in and sign-out audit events from Oracle Access Management (OAM), providing visibility into user authentication activities across your Oracle Cloud environment. This integration captures detailed login events including authentication attempts, session activity, user identification, IP addresses, and access timestamps.

## Prerequisites
### 1. Oracle Cloud Account
You must have access to an **Oracle Cloud Account** with appropriate permissions to access the Oracle Access Management REST API and retrieve audit events.

**Important Security Note:** Audit events contain sensitive authentication data including user login attempts, IP addresses, and session information. Ensure proper access controls are in place when configuring this integration and follow the principle of least privilege when creating service credentials.

## Configuration
### Settings
| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Domain Name | string | true | The domain name for your Oracle Cloud service (e.g., `acmeco.fa.us2.oraclecloud.com`). |
| Username | string | true | Oracle Cloud service user |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

### Secrets
| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Password | string | true | Password for the Oracle Cloud user |

## Authentication
This integration uses HTTP Basic Authentication with the Oracle Access Management REST API:
- **Username:** Oracle Cloud service user
- **Password:** User password

The credentials are automatically encoded and sent in the `Authorization` header as `Basic <base64-encoded-credentials>`.

## Data Collection
- Login events are collected incrementally based on the `accessTime` timestamp.
- Events include sign-in attempts, sign-out events, authentication successes, and authentication failures.
- Each event contains user identification, IP address, status, and Oracle-specific identifiers.

## Related Articles
- [Oracle Access Management REST API Documentation](https://docs.oracle.com/en/cloud/saas/applications-common/25d/farca/op-https-servername-oam-services-rest-access-api-v1-audit-events-get.html)

## Sample Record
```json
{
    "accessTime": "2025-11-26T18:04:05.305263Z",
    "attributeMap": {
        "attribute": {
            "key": "sessionId",
            "value": "WebClient"
        }
    },
    "eventID": "1174",
    "ipAddress": "90.24.46.225",
    "oracleECID": "3ed92cb6-9703-24db-f5a6-5d49ea40c3b9",
    "status": "SUCCESS",
    "type": "SessionCreated",
    "userID": {
        "loginID": "PeterMiller@example.com",
        "loginType": "",
        "userDN": "cn=Peter Miller,ou=users,dc=example,dc=com",
        "userGUID": ""
    }
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.