Collect Onfido logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This parser extracts fields from Onfido SYSLOG and JSON formatted logs, mapping them to the UDM. It parses the message field using grok, handles JSON payloads if present, and maps specific product event types to UDM event types. This includes setting the event type to USER_LOGIN for successful logins and USER_UNCATEGORIZED for other events. It also populates UDM fields for user information, source IP, and security result details.

Before you begin

• Ensure that you have a Google SecOps instance.
• Ensure that you have privileged access to Onfido Dashboard.

Configure a feed in Google SecOps to ingest the Onfido logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed (for example, Onfido Logs).
4. Select Webhook as the Source type.
5. Select Onfido as the Log type.
6. Click Next.
7. Optional: Specify values for the following input parameters:
   • Split delimiter: the delimiter that is used to separate log lines, such as \n.
   • Asset namespace: the asset namespace.
   • Ingestion labels: the label applied to the events from this feed.
8. Click Next.
9. Review the feed configuration in the Finalize screen, and then click Submit.
10. Click Generate Secret Key to generate a secret key to authenticate this feed.
11. Copy and store the secret key. You cannot view this secret key again. If needed, you can regenerate a new secret key, but this action makes the previous secret key obsolete.
12. From the Details tab, copy the feed endpoint URL from the Endpoint Information field. You need to specify this endpoint URL in your client application.
13. Click Done.

Create an API key for the webhook feed

1. Go to Google Cloud console > Credentials.

   Go to Credentials

2. Click Create credentials, and then select API key.

3. Restrict the API key access to the Google Security Operations API.

Specify the endpoint URL

1. In your client application, specify the HTTPS endpoint URL provided in the webhook feed.

2. Enable authentication by specifying the API key and secret key as part of the custom header in the following format:

   X-goog-api-key = API_KEY
   X-Webhook-Access-Key = SECRET
   

   Recommendation: Specify the API key as a header instead of specifying it in the URL.

3. If your webhook client doesn't support custom headers, you can specify the API key and secret key using query parameters in the following format:

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

   Replace the following:

   • ENDPOINT_URL: the feed endpoint URL.
   • API_KEY: the API key to authenticate to Google SecOps.
   • SECRET: the secret key that you generated to authenticate the feed.

Configure the Onfido webhook

1. Sign in to the Onfido Dashboard.
2. Go to Settings > Webhooks.
3. Click Add Webhook.

4. Specify values for the following input parameters:

   • Webhook URL: enter the <ENDPOINT_URL> of the Google SecOps API endpoint.
   Note: Append the <API_KEY> and <SECRET> to the endpoint URL <ENDPOINT_URL>?key=<API_KEY>&secret=<SECRET>.
   • Events: select the events that should trigger the webhook (for example, select check.completed or report.completed).

5. Click Save to create the webhook.

UDM Mapping Table

Log Field	UDM Mapping	Logic
category	security_result.category_details	The value of the category field from the raw log is assigned to security_result.category_details.
check_id	metadata.product_log_id	The value of the check_id field extracted from the json_data field in the raw log is assigned to metadata.product_log_id. If prod_evt_type is "Successful login", the value "AUTHTYPE_UNSPECIFIED" is assigned.
	metadata.event_timestamp	The timestamp from the raw log entry is converted to epoch seconds and assigned to metadata.event_timestamp.
	metadata.event_type	If prod_evt_type is "Successful login", the value USER_LOGIN is assigned. Otherwise, USER_UNCATEGORIZED is assigned.
	metadata.product_name	The parser code sets the value to "ONFIDO".
prod_evt_type	metadata.product_event_type	The value of the prod_evt_type field from the raw log is assigned to metadata.product_event_type.
	metadata.vendor_name	The parser code sets the value to "ONFIDO".
	metadata.product_version	The parser code sets the value to "ONFIDO".
security_result.action	security_result.action	If prod_evt_type is "Successful login", the value ALLOW is assigned.
src_ip	principal.ip	The value of the src_ip field from the raw log is assigned to principal.ip.
user_email	target.user.email_addresses	The value of the user_email field from the raw log is assigned to target.user.email_addresses.
user_name	target.user.user_display_name	The value of the user_name field from the raw log is assigned to target.user.user_display_name.

Changes

2023-03-10

• Newly created parser.