SSO History

To return a log of SSO activity for your organization in ThreatStream.

Request

/api/v1/ssohistory/

Bulk HTTP Method: GET

Response

Format: JSON

Number of rows returned (by default): 20

Attributes: See table below.

Attributes

Attribute Description
action

Actions logged by the SSO History API include:

  • SSO Configuration Changed—logged when the Manage Users With configuration is updated
  • Permission Map Updated—logged when the user permission mapping between AD Group names and ThreatStream permissions is updated
  • Break-glass Account—logged when the break glass user configuration is updated
  • Login Attempt—logged users attempt to log in, regardless of outcome
  • Login Success—logged when users successfully authenticate to ThreatStream
  • Login Fail—logged when users didn't succeed to authenticate to ThreatStream
  • User Logged Out—logged when users log out of ThreatStream
  • Create User—logged when a new user is created
  • Reactivate User—logged when a previously deactivated user is activated
  • User Permissions—logged when ThreatStream detects a change on AD user permissions
Deployment type

Type of deployment configured to use SSO.

Possible values include Cloud and OnPrem
id Unique identifier for the logged action.
idp Name configured for your identity provider.
ts Timestamp of the logged action.
user_email Email address of the ThreatStream user associated with the logged action.

Example

Request:

Copy 
curl "https://api.threatstream.com/api/v1/ssohistory/" -H 'Authorization: apikey <username>:<api_key>'

Response:

Copy 
{
"action": "Login Attempt",
"deployment_type": "OnPrem",
"id": 1000000019,
"idp": "adfs-onprem",
"resource_uri": "/api/v1/ssohistory/1000000019/",
"ts": "2020-10-01T10:07:23.916639",
"user_email": "example@test.net"
}