Arctic Wolf OneLogin Connector — Verification & Decommission

Cadence: Quarterly verification + immediate action on IdP change Owner: Infrastructure (Rory) Related story: AWMDR-009 Estimated time: 20 minutes

Purpose

Confirm whether the Arctic Wolf OneLogin connector is still needed, is still configured correctly, and — if OneLogin has been retired at Cirius — cleanly remove the connector so Arctic Wolf isn't polling a dead integration.

Pairs with the full ingestion validation runbook.

Current state (as of 2026-04)

Primary identity provider at Cirius: Microsoft Entra ID (Azure AD). All human user authentication, conditional access, MFA enforcement, and PAM live in Entra. The Arctic Wolf Azure connector (app c474a690-4186-476e-9c01-b3dcbfdafee9) reads sign-in and audit logs from Entra directly.

OneLogin historically served as an SSO for a subset of SaaS applications prior to the Entra consolidation. As of this runbook's creation, OneLogin's status at Cirius must be verified by the operator running this check — the repository does not contain Terraform or configuration for an active OneLogin tenant. If OneLogin is no longer in use, the Arctic Wolf OneLogin connector should be decommissioned (see the Decommission section below).

Operator action on first run: confirm OneLogin status with Rory and update the "Current state" section above with a definitive "in use" / "retired" answer, plus the retirement date if applicable.

Scenario A — OneLogin IS still in use

What the connector captures

OneLogin's event API (Events API v1 or v3 depending on AW connector version) exposes the full OneLogin event stream. The connector pulls, at minimum:

Event category	Examples	Detection value
Authentication	User login success, login failure, MFA challenge, MFA failure	Brute force, MFA bypass attempts, credential stuffing
User lifecycle	User created, user deleted, user suspended, user reactivated	Rogue account creation, shadow admin
Role / group	Role assigned/removed, group membership changed	Privilege escalation
App access	App assigned to user, app removed, app launched	Unauthorized app access
Admin	Admin logged in, API key created, connector configured	Admin account compromise
Session	Session revoked, password reset	Concierge review of abnormal sessions

Verify connector status

1. Portal check: Arctic Wolf portal → Configuration → Cloud Connectors → OneLogin.
   • Status should be Active / Healthy.
   • Last Sync should be within the last hour.
   • Events / 24h should be non-zero (exact number depends on OneLogin user activity).
2. Cross-check in OneLogin admin console:
   • Log in to the Cirius OneLogin admin tenant.
   • Activity → Events → filter API client = Arctic Wolf (the API credential name Arctic Wolf set up during onboarding).
   • Confirm events are being read on the expected cadence.
3. Credential health:
   • In OneLogin admin → Developers → API credentials — confirm the Arctic Wolf API credential still exists, is enabled, and isn't within 60 days of expiration.
   • If close to expiration, coordinate with Arctic Wolf Concierge to rotate.

Common issues

Symptom	Likely cause	Fix
No events in last 24h	API credential expired or disabled	Re-enable/rotate in OneLogin admin, notify AW Concierge
Portal shows "Authentication failed"	OneLogin admin rotated the API secret	Rotate on both sides (OneLogin → AW)
Partial event types missing	API credential scope reduced	Check OneLogin scopes: Events API (read), Users (read minimum)
Portal "Not Reporting" on OneLogin user devices	Expected if OneLogin doesn't manage endpoints — it's an IdP, not EDR	No action

Scenario B — OneLogin has been retired

If Cirius has fully migrated to Entra and OneLogin is no longer authoritative for any user, application, or automation:

Decommission checklist

• [ ] Confirm migration is complete — all users / apps now authenticating against Entra (check with Rory).
• [ ] In OneLogin admin console:
  • [ ] Disable the Arctic Wolf API credential (don't delete yet — 30-day rollback window).
  • [ ] Screenshot the events API last-call timestamp for audit.
• [ ] In Arctic Wolf portal:
  • [ ] Open a Concierge case: "Remove OneLogin connector — OneLogin retired at Cirius on <date>."
  • [ ] Confirm connector removed from Portal → Configuration → Cloud Connectors.
  • [ ] Confirm no "OneLogin not reporting" banners appear on the dashboard post-removal.
• [ ] In Cirius documentation:
  • [ ] Update bedrock-docs/compliance/ identity inventory to reflect Entra-only.
  • [ ] Mark the AWMDR-009 story closed with a pointer to the decommission date.
  • [ ] Update the "Current state" section of this runbook.
• [ ] After the 30-day rollback window:
  • [ ] Delete the Arctic Wolf API credential in OneLogin admin (final removal).
  • [ ] If the OneLogin tenant itself is also being retired, coordinate tenant termination with billing (separate change ticket).

Detection gap considerations

When the OneLogin connector is removed, ensure the Entra connector has full coverage:

• SignInLogs + AuditLogs: confirmed via Arctic Wolf Azure connector.
• Conditional Access events: captured in Entra audit logs.
• MFA challenges: captured in Entra sign-in logs (AuthenticationRequirement, AuthenticationDetails).
• App assignments: captured in Entra audit logs as "Add app role assignment" events.

If anything was uniquely visible through OneLogin and is NOT represented in Entra (rare — usually a legacy SaaS app not Entra-federated), flag it as a coverage gap before removing the connector.

Escalation

Issue	Path
Connector showing unhealthy >4h	AW Concierge case
OneLogin API credential expiring <30 days	Rory + Concierge (coordinate rotation)
Events missing entire category	AW Concierge P2 (connector config issue)
Uncertain whether OneLogin is still in use	Rory — do not assume; confirm before removal

Validation log

Quarter	Date	Operator	OneLogin status (in use / retired)	Connector healthy	Notes
Q2 2026	2026-04-16	kobe	verify with Rory	—	Initial runbook creation