Ping Identity PingOne Advanced Identity Cloud Integration

TL;DR

Overview

PingOne Advanced Identity Cloud (formerly ForgeRock Identity Cloud) is a SaaS-based identity and access management (IAM) platform used for workforce, consumer, and B2B identity use cases such as authentication, authorization, session management, and application configuration. Its audit and debug log sources capture every access call, authentication tree execution, session lifecycle event, configuration change, and internal service-to-service access made within the tenant, including the actor, action, timestamp, and outcome. Integrating these logs with Hunters allows security teams to detect credential abuse, unauthorized configuration changes, anomalous login patterns, and lateral movement within the identity fabric. By correlating authentication attempts, OAuth token issuance, session creation, and configuration changes with the rest of the environment's telemetry, Hunters can surface identity-centric threats that would otherwise be siloed within the IAM platform.

Supported data types

PingOne Advanced Identity Cloud Audit Logs

Table name: ping_identity_advanced_identity_cloud_audit_logs

This data type contains audit and debug events from PingOne Advanced Identity Cloud, including access attempts, authentication tree execution, session lifecycle events, and configuration changes. Each record wraps an inner payload object (the actual audit event, with fields like actor, action, outcome, client/server IP, and HTTP request details) inside an outer envelope carrying a top-level timestamp, type, and optionally source. Multiple event topics — access, activity, authentication, and config — share this same envelope/payload structure and are treated as a single data type, making the logs valuable for detecting credential abuse, anomalous login behavior, and unauthorized configuration changes.

Expected format

Logs are expected in JSON format.

{"payload": {"_id": "a1b2c3d4-e5f6-4789-a123-b456c789d012-783933", "client": {"ip": "203.0.113.17"}, "component": "OAuth", "eventName": "AM-ACCESS-ATTEMPT", "http": {"request": {"headers": {"content-type": ["application/x-www-form-urlencoded"], "host": ["tenant-env.example.com"], "user-agent": ["Apache-HttpClient/4.5.13 (Java/11.0.11)"], "x-forwarded-for": ["203.0.113.17, 198.51.100.22, 192.0.2.44"], "x-forwarded-proto": ["https"]}, "method": "POST", "path": "https://tenant-env.example.com/am/oauth2/realms/root/realms/alpha/access_token", "secure": true}}, "level": "INFO", "realm": "/alpha", "request": {"detail": {"client_id": "ClientApp123", "grant_type": "client_credentials", "scope": "fr:idm:*"}}, "source": "audit", "timestamp": "<dateTime>", "topic": "access", "transactionId": "1634116808645-2e50ecbf0df5407a6870-226587/0"}, "timestamp": "<dateTime>", "type": "application/json"}

Send data to Hunters

Hunters supports the collection of Ping Identity logs using API.

To connect Ping Identity logs:

1. Create API credentials in the Ping Identity console with read access to the relevant data, following the vendor documentation:
   • Audit and debug log sources
   • Pulling audit and debug logs
2. Connect the data source in the Hunters portal with those credentials, as described in this section. Hunters pulls the data from the vendor API on a schedule.