Skip to main content

​
After this article

You’ll know how Lumos posts event data to your SIEM integration and which Lumos events are sent to your SIEM integration.

​
Log format

Lumos posts events to your SIEM integration as a JSON payload in the following format.

​
Event types

The event types in the sections below are logged to your SIEM by Lumos. These are stored in the event_type field in the JSON payload. Events are organized by category below. Access Requests Access Request Notifications and Reminders Access Request Escalations Access Reviews Access Review Escalations Account Actions via Integration Entitlement Actions via Integration Admin Configuration Admin Account Status Updates AppStore Webhooks Pre-Approval Rules Time-Based Access Inactivity Workflows ITSM Tickets Onboarding and Offboarding Lifecycle Management Settings Error Tasks Manual Tasks Vendor Agreements Workflows Other

​
Actor types

In the event payload, Lumos tells you what type of actor initiated the event in the actor_type field and sends a payload of data about them as part of the actor data.

​
Target types

For every event, there are one-to-many targets that were acted upon by that event. The type of target is specified in the target_type field and information about the targets is stored in a list as part of the targets field.
Target TypeDescriptionPayload
APPProvides information about the application.{ "app_id": str, "name": str }
APP_INSTANCEProvides information about this specific instance of an application.{ "app_id": str, "instance_id": str, "user_friendly_label": str }
LUMOS_USERThe Lumos User on which the action (e.g., provisioning) was performed.{ "email": str, "given_name": str, "family_name": str }
USER_APP_RELATIONSHIPThe relationship between a Lumos User and an App.{ "user": { "email": str, "given_name": str, "family_name": str }, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str } }
ACCOUNTA user’s account in a specific application.{ "identifier": str, "email": str, "given_name": str, "family_name": str, "username": str, "user": { "email": str, "given_name": str, "family_name": str }, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str } }
ACCESS_REQUESTA request for access created from the AppStore.{ "target_user": { "email": str, "given_name": str, "family_name": str }, "requester_user": { "email": str, "given_name": str, "family_name": str }, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str }, "access_length": str, "permissions": { "label": str, "value": str, "type": GROUP | PERMISSION, "source": OKTA | ONELOGIN | ... }, "business_justification": str }
ACCESS_REVIEWAn access review.{ "name": str }
ACCESS_REVIEW_DOMAIN_APPAn app within the access review.{ "status": IN_PREPARATION | ASSIGNING_REVIEWERS | ..., "review_type": ACCOUNTS | ENTITLEMENTS }
ACCESS_REVIEW_ACCOUNTAn account in an access review app.{ "email": str }
ACCESS_REVIEW_ACCOUNT_ENTITLEMENTA permission being reviewed for an account in an access review.{ "type": str, "label": str }
LUMOS_GROUPA group associated with an application (email provider, IdP).{ "name": str, "external_id": str }
PRE_APPROVAL_RULEA pre-approval rule for an AppStore app.{ "justification": str, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str } }
APP_GROUP_REQUEST_CONFIGThe configuration for a specific app Permission in the AppStore.{ "label": str, "value": str, "type": GROUP | PERMISSION, "source": OKTA | ONELOGIN | GSUITE | ... }
INLINE_WEBHOOKAn inline webhook.{ "hook_type": PROVISION | DEPROVISION | PRE_APPROVAL | REQUEST_VALIDATION, "name": str, "description": str }
ONBOARDING_RULEAn onboarding or access policy rule.{ "targets": str, "owner_id": int, "business_justification": str }
ESCALATION_POLICYAn AppStore or Access Reviews escalation policy.{ "name": str }