How do I set up the ForgeRock Identity Cloud app for Splunk?

Overview

The ForgeRock Identity Cloud app for Splunk captures audit and debug logs from Identity Cloud tenants. It includes a sample dashboard to graphically illustrate various captured metrics, for example, authentication events, identity registrations, and top active users. 

Once configured, the ForgeRock Identity Cloud app for Splunk polls the audit REST endpoints (/monitoring/logs) of your Identity Cloud tenants. The default poll interval is 30 seconds and the audit logging sources requested are:

• am-authentication
• am-access
• am-config
• idm-activity

See What logging sources are available in Identity Cloud? for further information on Identity Cloud logging sources.

The ForgeRock Identity Cloud app for Splunk is available for both Splunk Enterprise® and Splunk Cloud Platform™.

Sample dashboard

The sample dashboard provided by the ForgeRock Identity Cloud app displays the following data:

• Logins per day
• Login success per journey
• Journeys per 4 hour period
• Top users
• Top authentication nodes by name
• Top authentication nodes by type
• Identity updates per day
• Account status changes per day
• Activity by country

Prerequisites

• You have one or more working Identity Cloud tenants.
• You have signed up for a Splunk account.
• You have downloaded and installed Splunk Enterprise or have signed up for Splunk Cloud.

Downloading and installing the ForgeRock Identity Cloud app

1. In Splunk Enterprise or Splunk Cloud, click the Apps gear icon.
2. Click Browse more apps.
3. Search for the ForgeRock Identity Cloud app, and then click Install.
4. Enter your Splunk.com login username and password, and agree to the terms and conditions.
5. Click Agree and Install.
6. Once the app has been installed, click Open the App to open the ForgeRock Identity Cloud Dashboard.

Configuring the ForgeRock Identity Cloud app

1. In Splunk Enterprise or Splunk Cloud, click ForgeRock (in the App list) to open the ForgeRock Identity Cloud Dashboard.
2. Click Inputs on the menu bar.
3. Click Create New Input.
4. Enter a name and your Identity Cloud tenant URL, for example, https://<tenant-env-fqdn>, where <tenant-env-fqdn> is your Identity Cloud tenant.
5. Enter the API Key ID and API Key Secret that you'll use to authenticate to the Identity Cloud REST API endpoints. See Get an API key and secret for further information on creating Identity Cloud API credentials.

6. Click Add.
7. Ensure the Status is Enabled.
8. If required, repeat Steps 3 to 7 to add more tenants.
9. Click ForgeRock Identity Cloud Dashboard on the menu bar.
10. Under Tenant, choose the name of the tenant to view. Note that the dropdown is populated dynamically when data starts to be ingested, so you may need to wait several minutes before the tenant names are visible. Similarly, the data widgets on the dashboard will only display results once relevant data has been captured. This may take several minutes, depending on the activity of the tenant.

The sample dashboard includes widgets showing examples of how audit logs can be searched, and results categorized and visualized. You can hover your mouse pointer over any widget and click the magnifying glass icon to see the search string and raw data. 

Searching audit data

You can view the details of Identity Cloud audit log data by performing searches.

1. In Splunk Enterprise or Splunk Cloud, click ForgeRock (in the App list) to open the ForgeRock Identity Cloud Dashboard.
2. Click Search on the menu bar.
3. Enter your search string and select a timeframe.
4. Click the magnifying glass search icon.

See the Search Manual for further information on Splunk's Search app.

Example search

The following search string returns all audit events associated with authentication nodes from the journey called "Login" and for a tenant input called “forgerock”:

source="forgerock" realm="/alpha" eventName="AM-NODE-LOGIN-COMPLETED" entries{}.info.treeName="Login"

The search results will appear similar to this: 

Other Example Searches

See Also

What logging sources are available in Identity Cloud?

Does Identity Cloud include an audit logging service?

View audit and debug logs