---
title: "Ping Identity PingOne Advanced Identity Cloud Integration"
slug: "ping-identity-advanced-identity-cloud"
updated: 2026-11-03T16:33:47Z
published: 2026-11-03T16:33:47Z
canonical: "docs.hunters.ai/ping-identity-advanced-identity-cloud"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Ping Identity PingOne Advanced Identity Cloud Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| PingOne Advanced Identity Cloud Audit Logs |  | ✅ | ✅ | ✅ | `ping_identity_advanced_identity_cloud_audit_logs` | JSON | API |

## Overview

PingOne Advanced Identity Cloud (formerly ForgeRock Identity Cloud) is a SaaS-based identity and access management (IAM) platform used for workforce, consumer, and B2B identity use cases such as authentication, authorization, session management, and application configuration. Its audit and debug log sources capture every access call, authentication tree execution, session lifecycle event, configuration change, and internal service-to-service access made within the tenant, including the actor, action, timestamp, and outcome. Integrating these logs with Hunters allows security teams to detect credential abuse, unauthorized configuration changes, anomalous login patterns, and lateral movement within the identity fabric. By correlating authentication attempts, OAuth token issuance, session creation, and configuration changes with the rest of the environment's telemetry, Hunters can surface identity-centric threats that would otherwise be siloed within the IAM platform.

## Supported data types

### PingOne Advanced Identity Cloud Audit Logs

**Table name:** `ping_identity_advanced_identity_cloud_audit_logs`

This data type contains audit and debug events from PingOne Advanced Identity Cloud, including access attempts, authentication tree execution, session lifecycle events, and configuration changes. Each record wraps an inner `payload` object (the actual audit event, with fields like actor, action, outcome, client/server IP, and HTTP request details) inside an outer envelope carrying a top-level timestamp, type, and optionally source. Multiple event topics — access, activity, authentication, and config — share this same envelope/payload structure and are treated as a single data type, making the logs valuable for detecting credential abuse, anomalous login behavior, and unauthorized configuration changes.

**Expected format**

Logs are expected in JSON format.

```
{"payload": {"_id": "a1b2c3d4-e5f6-4789-a123-b456c789d012-783933", "client": {"ip": "203.0.113.17"}, "component": "OAuth", "eventName": "AM-ACCESS-ATTEMPT", "http": {"request": {"headers": {"content-type": ["application/x-www-form-urlencoded"], "host": ["tenant-env.example.com"], "user-agent": ["Apache-HttpClient/4.5.13 (Java/11.0.11)"], "x-forwarded-for": ["203.0.113.17, 198.51.100.22, 192.0.2.44"], "x-forwarded-proto": ["https"]}, "method": "POST", "path": "https://tenant-env.example.com/am/oauth2/realms/root/realms/alpha/access_token", "secure": true}}, "level": "INFO", "realm": "/alpha", "request": {"detail": {"client_id": "ClientApp123", "grant_type": "client_credentials", "scope": "fr:idm:*"}}, "source": "audit", "timestamp": "<dateTime>", "topic": "access", "transactionId": "1634116808645-2e50ecbf0df5407a6870-226587/0"}, "timestamp": "<dateTime>", "type": "application/json"}
```

## Send data to Hunters

Hunters supports the collection of Ping Identity logs using API.

**To connect Ping Identity logs:**

1. Create API credentials in the Ping Identity console with read access to the relevant data, following the vendor documentation:
  - [Audit and debug log sources](https://docs.pingidentity.com/pingoneaic/tenants/audit-debug-log-sources.html)
  - [Pulling audit and debug logs](https://docs.pingidentity.com/pingoneaic/tenants/audit-debug-logs-pull.html)
2. Connect the data source in the Hunters portal with those credentials, as described in [this section](https://docs.hunters.ai/docs/connect-a-data-source-using-apiwebhook). Hunters pulls the data from the vendor API on a schedule.