---
title: "Lumos"
slug: "lumos"
updated: 2025-11-13T10:31:28Z
published: 2025-11-13T10:31:28Z
canonical: "docs.hunters.ai/lumos"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Lumos

****TL;DR****

| Supported data types | 3rd party Detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Lumos Activity logs |  |  |  | ✅ | lumos_activity_logs | NDJSON | S3, Webhook |

---

## Overview

Lumos is a SaaS cybersecurity platform specializing in autonomous identity governance and access management.

Designed to secure modern cloud environments, Lumos helps organizations manage user permissions, enforce policies, and automate access![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/lumos.jpeg) lifecycle processes seamlessly. Built on robust AWS infrastructure. it offers enterprise-grade security with SOC 2 compliance, encryption, and continuous monitoring. Lumos integrates easily with popular platforms like Office 365 and Google Workspace, providing real-time visibility and control over identities and privileges. Its powerful automation and risk management capabilities enable businesses to reduce security risks while improving operational efficiency.

## Supported data types

### Lumos Activity logs

**Table name:** `lumos_activity_logs`

[Lumos Activity Logs](https://www.lumos.com/) provide detailed records of user actions and events within the Lumos platform. These logs capture key information such as event types, timestamps, and actor details (including email, name, and actor type), enabling organizations to audit access requests, approvals, and system activity. The logs are structured in JSON format and can be integrated into security pipelines or SIEM tools for monitoring, compliance, and threat detection purposes.

## Send data to Hunters

Hunters supports the ingestion of Lumos logs via two methods:

1. **S3 List / Notifications**
2. **Webhooks**

**To connect Lumos logs via S3:**

1. Export your logs from Lumos to an AWS S3 bucket by following [this guide](https://developer.harness.io/docs/cloud-cost-management/ccm-auditing).
2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](/v1/docs/connect-data-through-aws-s3).

**To connect Lumos logs via Webhooks:**

1. Approach Hunters support to receive a URL and a bearer token to [configure a Webhook](https://portal.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/document/v1/view/5a850b11-74fb-43ef-9620-2159a0ee1c59/en) on Lumos.
2. Go to Lumos **Admin Console.**
3. Navigate to **Integrations** or **Settings → Webhooks**.
4. Create a new webhook endpoint:
  - Provide the **URL** (you received from Hunters Support)
  - Set **event types** you want to subscribe to (e.g., access requests, logins, approvals)
  - Choose the **authentication method** (optional)
5. Save and test the webhook to confirm delivery.

## Expected format

Logs are expected in JSON format.

```json
{ "event_hash": "REDACTED_HASH", "event_type": "SEND_REQUEST_APPROVAL_FOR_ACCESS_REQUEST_EMAIL", "outcome": "SUCCEEDED", "event_type_user_friendly": "Requested Approval", "actor": { "actor_type": "Lumos" }, "targets": [ { "target_type": "User", "email": "user1@example.com", "given_name": "FirstName1", "family_name": "LastName1" }, { "target_type": "Access Request", "uuid": "uuid-access-request-1", "target_user": { "email": "user2@example.com", "given_name": "FirstName2", "family_name": "LastName2" }, "requester_user": { "email": "user2@example.com", "given_name": "FirstName2", "family_name": "LastName2" }, "app": { "uuid": "uuid-app-1", "app_id": "app.example.com", "instance_id": "instance.example.com", "user_friendly_label": "ExampleApp" }, "access_length": "Unlimited", "permissions": [ { "label": "Read-only Administrator", "value": "Read-only Administrator", "type": "GROUP", "source": "SOURCE_SYSTEM", "group_id": "group-id-1" } ], "business_justification": "Business justification goes here" } ], "event_began_at": "2025-07-24T11:33:59.669006", "event_metadata": {} }
```

The second stage of the Hunters Pipeline, responsible for identifying suspicious activity from your raw data, and turning that into leads.

Security Operations Center. An organizational function that exists in many enterprises, responsible for monitoring, detecting, preventing, investigating, and responding to cyber threats around the clock.