JumpCloud collector

[ 1 Configuration requirements ] [ 2 Overview ] [ 3 Devo collector features ] [ 4 Data sources ] [ 5 Flattening preprocessing ] [ 6 Vendor setup ] [ 7 Minimum configuration required for basic pulling ] [ 8 Accepted authentication methods ] [ 9 Run the collector ] [ 10 Collector services detail ] [ 11 Collector operations ] [ 12 Change log for v1.x.x ]

Configuration requirements

To run this collector, there are some configurations detailed below that you need to consider.

Configuration	Details

Configuration	Details
JumpCloud credentials	It is necessary to have your credentials so you can configure the collector.
API token	It is necessary to have API Token.
API Key	You need to save your API key.

More information

Refer to the Vendor setup section to know more about these configurations.

Overview

JumpCloud works as a directory-as-a-service software solution that is designed to manage and connect hundreds of users to their respective applications, files, networks, and systems.

Directory insights allow you to read event logs, view activity in your directory, and monitor user authentications to the console, RADIUS, LDAP, and SSO apps. Directory insights analyze the audit trails that lead to critical events so you know what, where, how, and who of your directory activities.

Devo collector features

Feature	Details

Feature	Details
Allow parallel downloading (`multipod`)	`Not allowed`
Running environments	`Collector server` `On-premise`
Populated Devo events	`Table`
Flattening preprocessing	`No`

Data sources

Data source	Description	API endpoint	Collector service name	Devo table	Available from release

Data source	Description	API endpoint	Collector service name	Devo table	Available from release
directory	Logs on activity in the Portal, including admin changes in the directory and admin/user authentications to the Portal.	`/directory/v1/events` `data body:` `service: “` `directory“`	`directory`	`auth.jumpcloud.directory.events`	`v1.0.0`
systems	Logs about user authentications to systems including agent related events on lockout, password changes, and File Disk Encryption key updates.	`/directory/v1/events` `data body:` `service: "` `systems"`	`systems`	`auth.jumpcloud.system.events`	`v1.0.0`
sso	Logs on user authentications to SAML applications.	`/directory/v1/events` `data body:` `service: "` `sso"`	`sso`	`auth.jumpcloud.sso.events`	`v1.0.0`
radius	Logs on user authentications to RADIUS used for wifi and VPNs.	`/directory/v1/events` `data body:` `service: "` `radius"`	`radius`	`auth.jumpcloud.radius.events`	`v1.0.0`
ldap	Logs about user authentications to LDAP, including LDAP bind and search events types.	`/directory/v1/eventsdata body:` `service: "` `ldap"`	`ldap`	`auth.jumpcloud.ldap.events`	`v1.0.0`
mdm	Logs about MDM command results.	`/directory/v1/events` `data body:` `service: “` `mdm“`	`mdm`	`auth.jumpcloud.mdm.events`	`v1.0.0`
All events	Logs about all events.	`/directory/v1/events` `data body:` `service: “` `all“`	`all`	It has autocategorization, it depends on the type of event: `auth.jumpcloud.directory.events` `auth.jumpcloud.system.events` `auth.jumpcloud.sso.events` `auth.jumpcloud.radius.events` `auth.jumpcloud.ldap.events` `auth.jumpcloud.mdm.events`	`v1.0.0`

Flattening preprocessing

Data source	Collector service	Optional	Flattening details

Data source	Collector service	Optional	Flattening details
Source	Service	`No`	Flattening steps

Vendor setup

There are some requirements to set up this collector:

Generate API Token

Login into JumpCloud.
In the Administration Center go to the username drop-down in the upper right corner.
Retrieve your API key from the API settings.

API Considerations

This API key is associated with the currently logged-in administrator. The API keys will be different for other administrators.

Keep the API Key

Keep this API key secret as it grants full access to any data accessible via your JumpCloud console account. You can also reset your API key in the same location in the JumpCloud Admin Console.

Minimum configuration required for basic pulling

Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.

This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.

Setting	Details

Setting	Details
`api_key`	Token for use JumpCloud API

See the Accepted authentication methods section to verify what settings are required based on the desired authentication method.

Accepted authentication methods

Authentication method	Api key

Authentication method	Api key
Api key	REQUIRED

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Collector services detail

This section is intended to explain how to proceed with specific actions for services.

Events service

Collector operations

This section is intended to explain how to proceed with specific operations of this collector.

Change log for v1.x.x

Release	Released on	Release type	Details	Recommendations

Release

Released on

Release type

Details

Recommendations

v1.3.1

Feb 16, 2024

BUG fixing

Recommended version

v1.2.2

Jan 14, 2024

IMPROVEMENTSBUG fixing

Bug

Resolved the issue of sending the data at unknown.unknown
Upgraded DCSDK from 1.9.2 to 1.10.2
Ensure special characters are properly sent to the platform
Changed log level to some messages from info to debug
Changed some wrong log messages
Upgraded some internal dependencies
Changed queue passed to setup instance constructor
Ability to validate collector setup and exit without pulling any data
Ability to store in the persistence the messages that couldn't be sent after the collector stopped
Ability to send messages from the persistence when the collector starts and before the puller begins working
Ensure special characters are properly sent to the platform

-

v1.1.0

Aug 30, 2023

IMPROVEMENTS

Upgraded DCSDK from 1.5.1 to 1.9.2

New “templates” functionality
Functionality for detecting some system signals for starting the controlled stopping
Input objects sends again the internal messages to devo.collectors.out table
Upgraded DevoSDK to version 3.6.4 to fix a bug related to a connection loss with Devo
Refactored source code structure
Changed way of executing the controlled stopping
Minimized probabilities of suffering a DevoSDK bug related to “sender” to be null
Ability to validate collector setup and exit without pulling any data
Ability to store in the persistence the messages that couldn’t be sent after the collector stopped
Ability to send messages from the persistence when the collector starts and before the puller begins working
Ensure special characters are properly sent to the platform
Added a lock to enhance sender object
Added new class attrs to the setstate and getstate queue methods
Fix sending attribute value to the setstate and getstate queue methods
Added log traces when queues are full and have to wait
Added log traces of queues time waiting every minute in debug mode
Added method to calculate queue size in bytes
Block incoming events in queues when there are no space left