Identity Manager SIEM Support (4383374)

Identity Manager provides the ability to send data to a SIEM provider. What are the steps required to setup this feature?

Core One Identity SIEM Messages

Identity Manager provides the ability to send SIEM messages for specific definitions. To view the definitions included out of the box:

1. Open Designer
2. Select "Base Data"
3. Expand "Advanced" and select "SIEM Message Definitions"
4. To enable individual definitions, select the ones required, and change the property "Disabled" to "False".

To configure the Destination for these messages:

1. Open Designer
2. Select "Base Data"
3. Expand "General" and select "Configuration Parameters"
4. Expand "QBM" | "CEF"
5. Provide the parameter "HostnameOrIP", "Port" and "Protocol"

Sample messages received by Syslog

May 18 09:18:52 10.0.0.61 <14>May 18 09:14:28 vm-oneim-931 IdentityManager: CEF:0|One Identity|Identity Manager|9.3|10|Access request submitted|0|deviceCustomDate1=2026-05-18T09:06:29.9730000Z deviceCustomDate1Label=System_Timestamp duser=EMEA.USER msg=Identity USER, EMEA (EMEA.USER) has submitted an access request for CANADA BUSINESS ROLE

How does Identity Manager know when to send these messages to the SIEM system?

The schedule "Send object changes to syslog server" will run once every 30 minutes to send the recent messages to the SIEM system.