Grouper Users - Open Discussion List

["Black, Carey M." <>]

All,

Poking an old thread. 
So far I have received no comments/strategies.  ( Should I assume that no one 
is doing anything like this? )

-- 
Carey Matthew 

Office of the Chief Information Officer (OCIO)
Identity and Access Management - Security Engineer-Lead
614-292-6079 Office


-----Original Message-----
From: Black, Carey M. 
Sent: Saturday, May 26, 2018 11:29 PM
To: 

Subject: Grouper and Splunk

All,

Before I start to reinvent the wheel....

For those of you who use Grouper and Splunk....  (or any other SEIM tool )
        How/What data are you exporting from Grouper to Splunk?
                "Just" feeding it some of the standard log4J UI logs? Loader 
Logs? WS Logs? PSP/NG Logs?
                        Did you setup any specific log levels/classes 
specifically for Splunk visibility?
        Do you try to send Grouper audit data? ( "User audit" and/or "PIT 
audit" ? )
        Do you try to "limit"/"shape" the details that are headed to Splunk 
or just dumping it all?


Part of me thinks I should try to capture only this data and get it into 
Splunk:
        Membership changes in:
                External System of Record group changes ( loaded from: loader 
jobs, script integrations, etc... )
                Grouper System of Record Groups (Think:  manual groups 
maintained in Grouper, like includes/excludes )
                Access Policy groups ( any group "used by an external system")

        And not send data about membership changes all of the "group math" / 
intermediate role up groups between the SOR's and the Access Policies.
                And then parts of me thinks knowing who changed what about 
the group math structure would also be good to have logged too. ( Just not 
the membership changes for those groups.)

However, doing exactly that would take some work to identify/maintain the 
"right groups" and could be subject to "Opps, missed that group" problems too.
        ( Maybe use a custom change log consumer to directly emit the 
"Splunk" data in a "Splunk format" ?)

Anyone what to share their strategy?

-- 
Carey Matthew