Quick links

Most popular

Overview

Once you’ve obtained an Onum account, just a few steps are needed to complete the installation, depending on the type of deployment you require. Onum supports flexible deployment options, including both on-premises and cloud environments.

In case you have any question regarding the deployment and installation process, please .

These articles contain information on functionalities across the entire platform.

Welcome to Falcon Onum! This guide will help you start working with Onum, a powerful tool designed to enhance your data analysis and processing capabilities.

Accessing Onum

Once you get your Onum credentials, you only have to go to console.onum.com and enter them to access your Tenant.

A Tenant is a domain that contains a set of data in your organization. You can use one or various Tenants and grant access to as many as required. Learn more about working with Tenants in this article.

Logging in

Once in , there are several ways to log in:

• Log in with email address and password. Your password must be a minimum of 10 characters and include a combination of uppercase letters, lowercase letters, numbers, and symbols.

• Two-factor authentication

• Single Sign-On (SSO) with SAML

• Single Sign-On (SSO) with OpenID

Learn more about the different authentication types in .

Navigating the Interface

When you access the Onum app, you'll see , where you can see an overview of the activity in your Tenant.

You can access the rest of the areas in Onum using the left panel.

Create Your First Listener

Onum receives any data through Listeners.

These are logical entities created within a Distributor, acting as the gateway to the Onum system. Configuring a Listener involves defining an IP address, a listening port, and a transport layer protocol, along with additional settings depending on the type of Listener specialized in the data it will receive.

Access the Listeners area to start working with them. Learn how to create your first Listener .

Create Your First Data Sink

Onum outputs data via Data sinks. Use them to define where and how to forward the results of your streamlined data.

Access the Data sinks area to start working with them. Learn how to create your first Data sink .

Build Your First Pipeline

Use Pipelines to start transforming your data and build a data flow. Pipelines are made of the following components:

Learn more about Pipelines .

Use cases

Do you want to check the essential steps in Onum through specific Pipelines? Explore the most common use cases in .

Overview

In the Listeners, Pipelines, and Data sinks areas, you can view all the resources in your Tenant as cards or in a table.

In both views, you can:

• Click the magnifying glass icon to look for specific elements in the list. You can search by name, status, or tag.

• Display all the elements individually in a list or grouped by types. These grouping options vary depending on the area you are.

Table View

In the Table view, you can click the cog icon to begin customizing the table settings. You can reorder the columns in the table, hide or display the required ones or pin them.

Changes will be automatically applied. Click the Reset button to recover the original configuration.

• Click a row to open the details window, or double-click it to access the element and edit it.

• Use the buttons at the top right part of the table to expand or collapse each row in the table. This will change the level of detail of each element.

• Click the ellipsis button on each row to edit the element, copy its ID, or remove it.

Cards View

In this view, each element is displayed as a card that shows details about it.

• Click a card to open the details window, or double-click it to access the element and edit it.

• Click the ellipsis button on each card to edit the element, copy its ID, or remove it.

• Click the Add tag button and add the required tags to an element. For each tag you enter in the box, hit the Enter key. Click Save to add the tags.

Overview

The exponential growth of data ingestion volumes can lead to reduced performance, slow response times, and increased costs. With this comes the need to implement optimization strategies & volume reduction control. We help you cut the noise of large data streams and reduce infrastructure by up to 80%.

Gain deep insights from any type of data, using any format, from any source.

All of this...

@ the Edge

By collecting and observing that data at the edge, as close as possible to where it’s being generated, gain real-time observations and take decisive action to prevent network downtime, payment system failures, malware infections, and more.

Unlike most tools that provide data observation and orchestration, Onum is not a data analytics space, which is already served well by security information and event management (SIEM) vendors and other analytics tools. Instead, Onum sits as close as possible to where the data is generated, and well in front of your analytics platforms, to collect and observe data across every aspect of your hybrid network.

Start with the basics

Easy, flexible deployment in any environment while keeping them as close as possible to where the data is produced delivers unparalleled speed and efficiency, enabling you to cut the infrastructure you have dedicated to orchestration by up to 80%.

The Onum infrastructure consists of:

• Distributor: this is the service that hosts the Listener before forwarding it to Workers.

• Worker: this is the service that runs the Pipelines, receiving data from its Distributor and contained within a Cluster.

Where the vendor is Akamai, it's product is Guardicore. Right now we have the following product types/endpoints:

Inside each of those endpoints we have the YAML file to configure.

Where the vendor is Netskope, we have the following product types/endpoints:

• Alerts

• Events

Inside each of those endpoints we have the YAML file to configure.

Integrate with API Logs from the Cortex Platform using the HTTP Pull Listener using the data Integration API.

Where the vendor is Cisco, it's product is Umbrella. For Umbrella, right now we have the following product types/endpoints:

Inside each of those endpoints we have the YAML file to configure.

Where the vendor is SentinelOne, it's product is web API. For Web API, right now we have the following product types/endpoints:

Where the vendor is CrowdStrike, it's product is Falcon API. For Falcon API, right now we have the following product types/endpoints:

Inside each of those endpoints we have the YAML file to configure.

Where the vendor is Trend Micro, it's product is Vision one. For Vision one, right now we have the following product types/endpoints:

Inside each of those endpoints we have the YAML file to configure.

Onum offers you two different types of AI-powered assistants to help you build powerful Pipelines:

• Pipeline Assistant - Build your Pipeline structure using this assistant.

• Action Assistant - Once you've defined your Pipeline structure, you can configure each Action settings using this assistant.

Overview

Throughout the entire Onum platform, you can set a period to either narrow down or extend the data shown. You can either select a predefined period or apply a custom time range.

The related graph and resources will be automatically updated to display data from the chosen period. To remove a selected period, simply click the bin icon that appears next to the period to go back to the default time range (1 hour ago).

Predefined and Custom time ranges

As well as predefined time intervals, you can also define a custom time range. To do it, simply select the required starting and ending dates in the calendar.

Comparisons

The interesting thing about Onum is that you can directly see how much volume you have saved compared to past ingestions, telling you what is going well and what requires further streamlining.

The comparison is direct/equivalent, meaning all data shown is analyzed compared to the previously selected equivalent time range.

For example, if the time range is 1 hour, the calculation of differences will be carried out using the previous one hour before the current selection =

• Range selected: 10:00-11:00

• Comparison: 09:00-10:00

Again, let´s say you now wish to view data over the last 7 days. The percentages will be calculated by measuring the volume retrospectively two weeks ago with the previous week.

Overview

The Pipeline Assistant is an AI-powered chat feature designed to help users design and build their Pipelines. Any configuration requested through the chat will be automatically applied. Simply enter the results you expect from your Pipeline and the AI will generate a Pipeline structure according to your needs.

To start using it, create a new Pipeline, drag a Listener, and just click this icon at the bottom left corner:

Examples

Here are some example use cases where we ask for help from the Pipeline Assistant. Check the prompts we use and the resulting configuration in each example picture.

Filter most common priorities

Send a report of aggregated data to Jira

Overview

The Tick listener allows you to emit events on a defined schedule.

Onum Setup

Click Create listener when you're done.

Where the vendor is Agari, it's product is DMARC Protection. For DMARC Protection API, right now we have the following product types/endpoints:

• Alert events

• Audits

• Domains

The default tab that opens when in the Pipeline area is the Listeners tab, which shows all Listeners in your Tenant, as well as their labels.

Use the search bar to find a specific Listener or Label.

Edit a Listener

You can edit a label from the list by clicking the ellipses next to its name and selecting Edit.

This will open the Listener Configuration and Labels for you to modify.

Create Listener

If the Listener you wish to use in the Pipeline does not already exist, you can create it directly from this view using the Create Listener button in the bottom right of the tab. This will open the Listener Configuration window.

Add a Listener to your Pipeline

Go to to learn step by step.

Action

A unit of work performing a given operation on an event.

Overview

This article outlines the more complex calculations that go on behind the graphs you see.

In the , , and views, you will see detailed metrics on your events and bytes in/out, represented in a graph at the top of these areas.

The line graph represents the events in/out, and the bar graph represents bytes in/on. Hover over a point on the chart to show a tooltip containing the events and bytes in for the selected time, as well as a percentage of how much increase/decrease has occurred since the previous lapse of time since the one currently selected.

Overview

If your Onum installation is deployed in our Cloud, the configuration settings of a Listener would be slightly different from Listeners defined in an On-Premise deployment:

Overview

The following article outlines a basic data flow from your Check Point's Next-Generation Firewall (NGFW) to the Onum Syslog

Overview

The following article outlines a basic data flow from your Fortinet Next-Generation Firewall (NGFW) to the Onum Syslog Listener.

Overview

The following article outlines a basic data flow from your Palo Alto Next-Generation Firewall (NGFW) to the Onum Syslog Listener.

Next to the Listeners tab in the left menu, you'll see a number that indicates the Listeners that have pending updates. In this area, Listeners that have pending updates will show an Update tag.

Since Onum can process any data type, you may be wondering how to identify which is which. See the color legend below:

Overview

Essentially, Onum receives any data through Listeners. These are logical entities created within a Distributor, acting as the gateway to the Onum system. Due to this, configuring a Listener involves defining an IP address, a listening port, and a transport layer protocol, along with additional settings depending on the type of Listener specialized in the data it will receive.

A Push type of Listener passively sources data without explicitly requesting, whereas a Pull type is where the user actively requests data from an external source.

Click the Listeners tab on the left menu for a general overview of the Listeners configured in your Tenant and the events generated.

• The graph at the top plots the volume ingested by your listeners. Click Events to see the events in for all your Listeners, or Bytes to see a bar graph representing the bytes in. Learn more about this graph .

• Hover over a point on the chart to show a tooltip containing the Events and Bytes OUT for the selected time, as well as a percentage of how much increase/decrease has occurred between the previous lapse of time and the one currently selected.

At the bottom, you have a list of all the Listeners in your Tenant. You can switch between the Cards view, which shows each Listener in a card, and the Table view, which displays Listeners listed in a table. Learn more about the cards and table views .

Narrow Down Your Data

There are various ways to narrow down what you see in this view:

Add Filters

Add filters to narrow down the Listeners you see in the list. Click the + Add filter button and select the required filter type(s). You can filter by:

• Name - Select a Condition (Contains, Equals, or Matches) and a Value to filter Listeners by their names.

• Version - Filter Listeners by their version.

• Type - Choose the Listener type(s) you want to see in the list.

The filters applied will appear as tags at the top of the view.

Select a Time Range

If you wish to see data for a specific time period, this is the place to click. Go to to dive into the specifics of how the time range works.

Select Tags

You can choose to view only those Listeners that have been assigned the desired tags. You can create these tags in the Listener settings or from the cards view. Press the Enter key to confirm the tag, then Save.

To filter by tags, click the Tags button, select the required tag(s) and click Save.

Create a Listener

Depending on your permissions, you can create a new Listener from this view. There are several ways to create a new Listener:

• From the Listeners view:

• Within a :

• From

Configuring your Listener involves various steps. You can open the configuration pane by creating a new Listener or by clicking a Listener in the Listener tab or the Pipeline view and selecting Edit Listener in the pane that opens.

Alternatively, click the ellipses in the card or table view and select Edit.

Overview

The following article outlines a basic data flow from Falcon LogScale Collector to the Onum Falcon LogScale Collector Listener.

Prerequisites

• You need to generate your TLS certificates for use in securing the sending of data to Onum. These will be required during the Falcon LogScale Collector Listener configuration and in the Falcon LogScale Collector setup. Learn how to generate these self-signed certificates in .

• You'll need to know your Onum distributor URL, as it will be required in the Falcon LogScale Collector setup. and we'll send it to you.

Onum setup

First, you must configure a new Falcon LogScale Collector Listener in Onum:

Falcon LogScale Collector setup

Now, access your Falcon NG-SIEM instance and follow these steps:

Overview

Onum receives data from Syslog, supporting TCP and UDP protocols. Select Syslog from the list of Listener types and click Configuration to start.

Onum Setup

Click Create listener when you're done.

Overview

Although there are only a limited number of Listener types available for use in Onum, the integration possibilities are endless. Onum is designed to be source-agnostic, ensuring you can ingest data from virtually any product or technology.

We achieve this through a strategic, two-pillar approach to our Listeners:

• First, we offer a growing suite of dedicated Listeners for specific technologies (such as Amazon S3, Microsoft Office, and others). These provide a streamlined configuration process for popular services.

Overview

When opening Onum, the Home area is the default view. Here you can see an overview of all the activity in your .

Use this view to analyze the flow of data and the change from stage to stage of the process. Here you can locate the most important contributions to your workflow at a glance.

Overview

Use Onum's labels to cut out the noise with filters and search criteria based on specific metadata. This way, you can categorize the events that Listeners receive before being processed in your .

As different log formats are being ingested in real-time, the same Listener may ingest different technologies. Labels are useful for categorizing events based on specific criteria.

When creating or editing a Listener, use Labels to categorize and assign filters to your data.

For most Listeners, you will see two main event categories on this screen:

Overview

Onum supports integration with Transmission Control Protocol.

Overview

Displays information about workbench alerts that match the specified criteria in a paginated list.

• The response contains an array of activities under the items field.

This method displays up to 10 entries per page. If the response body exceeds 50 MB in size, the method displays only one entry per page.

Overview

List of users visible to the currently-scoped User.

Configuration

Parameters

• parameters.domain will store the value of the API URL, excluding the endpoint paths like /v1/cp/oauth/token or /v1/cp/domains

Secrets

• secrets.client_id will reference to Agari's Client ID

• secrets.client_secret will reference to Agari's Client Secret.

Open the Secret fields and click New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the fields, or simply paste the given YAML:

Configure as YAML

Toggle this ON to enable a free text field where you can paste your YAML.

Manually configure

If you would rather configure each field, follow the steps below.

Temporal Window

Toggle ON to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

• Duration - 5 minutes (5m) as default, adjust based on your needs.

• Offset - initial offset should be 5m used to specify the index, or starting point, for the collection of items in the response.

• Format - RFC3339

Authentication Phase

Toggle ON to configure the authentication phase. This is required to get the token to pull data using OAuth.

• Type* - token

• Request Method* - POST (we would need to generate the JWT using the secrets client_id and client_secret)

Enumeration Phase

OFF

Collection Phase

• Pagination Type* - offsetLimitTo page through a collection of items, set the offset parameter to the first item of the next page. The offset calculation for the next page is: current_offset + current_count. The end of the collection is reached when the count of returned items is less than the limit.

• Limit - 200 (Maximum number of collection items to include in a response)

This HTTP Pull Listener now uses the data export API to extract alert events.

Click Create labels to move on to the next step and define the required if needed.

Overview

Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.

• The response is concatenated using AND condition (OR is not supported).

• The maximum result set size is >100.

• Offset is the zero-based number of incidents from the start of the result set.

Configuration

Parameters

Name - domain

Value - CortexXdrDomain

Secrets

• CortexXDRAuthorization will reference the Cortex XDR Authorization token.

• CortexXDRAuthId will reference the .

To add a Secret, open the Secret fields and click New secret:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Cortex incident Management fields, or simply paste the given YAML:

This HTTP Pull Listener now uses the data export API to extract events.

Click Create labels to move on to the next step and define the required if needed.

Overview

Get a list of alerts with multiple events.

• The response is concatenated using AND condition (OR is not supported).

• The maximum result set size is 100.

• Offset is the zero-based number of alerts from the start of the result set.

Cortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.

Configuration

Parameters

Name - domain

Value - CortexXdrDomain

Secrets

• CortexXDRAuthorization will reference the Cortex XDR Authorization token.

• CortexXDRAuthId will reference the .

To add a Secret, open the Secret fields and click New secret:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Cortex incident Management fields, or simply paste the given YAML:

This HTTP Pull Listener now uses the data export API to extract events.

Click Create labels to move on to the next step and define the required if needed.

Overview

Get the reports that match the filter and the data of the reports.

Configuration

Parameters

• Domain (Domain)

Secrets

• cisco_auth corresponds to the API Token used to authenticate the connection to Cisco Umbrella.

To add a Secret, open the Secret fields and click New secret:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Sentinel One Web API Reports fields, or simply paste the desired YAML.

Configure as YAML

Manually Configure

Temporal Window

Toggle ON to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

• Duration - 5 minutes (5m) as default, adjust based on your needs.

• Offset - 5m

• Format - EpochMillis

Authentication Stage

Toggle ON to configure the authentication phase. This is required to get the token to pull data using OAuth.

• Type* - token

• Request Method* - POST

• URL* - https://${parameters.domain}/auth/v2/token

Collection Phase

• Pagination Type* - offsetLimit

• Limit - 100

• Zero Index - false

Click Create labels to move on to the next step and define the required if needed.

Overview

Onum supports integration with .

Apache Kafka is a distributed, fault-tolerant, high-throughput, and scalable streaming platform. It's used for building real-time data pipelines and streaming applications.

Select Apache Kafka from the list of Listener types and click Configuration to start.

Prerequisites

In order to use this Listener, you must activate the environment variable in your distributor using docker compose (KAFKA_LISTENER_EXECUTION_ENABLED=true)

Apache Kafka Setup

You will need to set up a running Kafka cluster, with optional group IDs and Topics.

Onum Setup

Overview

Onum supports integration with Office 365 through the .

Office 365 provides a suite of cloud-based productivity tools and services, including apps like Word, Excel, PowerPoint, and Teams, along with online storage via OneDrive and advanced security features.

Prerequisites

1. You must register an application in Microsoft Entra ID (formerly Azure AD).

2. After registration, you'll need the Application (Client) ID, the Directory (Tenant) ID, and either a Client Secret (password) or a Certificate for authentication.

3. You must grant the necessary Microsoft Graph API permissions (e.g., Mail.Read.All, User.Read.All, Sites.Read.All).

Onum Setup

Click Create listener when you're done.

Overview

The following article outlines a basic data flow from Zscaler's Nanolog Streaming Service (NSS) to the Onum HTTP Listener.

Prerequisites

to get the cert information needed for TLS communication, which will be needed on the Listener setup.

Zscaler NNS Setup

Identify the NSS Feeds you want to send in the . Configure the required ingestion setup following the steps in the documentation.

Important notes

• The SIEM type will be Other.

• You must generate a JWT token and add it as an HTTP header. Add the word Bearer before the token value (Bearer <token>). The corresponding secret value will be added in the Onum configuration later.

Onum Setup

Click Create listener when you're done.

Overview

Onum supports integration with the OpenTelemetry.

OpenTelemetry is a collection of APIs, SDKs, and tools. Use it to instrument, generate, collect, and export telemetry data (metrics, logs, and traces) to help you analyze your software’s performance and behavior.

Prerequisites

to get the cert information needed for TLS communication, which will be needed on the Listener setup.

Open Telemetry Setup

In order to begin sending data, you must firstly Implement OpenTelemetry SDK and Instrumentation.

Then, you'll need to configure the OpenTelemetry Collector.

The Collector is configured via a YAML file (config.yaml), which defines a processing pipeline with three main component types:

• Receivers: Define how the Collector accepts incoming telemetry. The most common is otlp (OpenTelemetry Protocol), which listens for data from your applications over gRPC (port 4317) or HTTP (port 4318).

• Processors: Define how data is modified, filtered, or enriched (e.g., batch for efficient export, memory_limiter to prevent crashes, or processors to add metadata).

• Exporters: Define where the Collector sends the data.

A minimal configuration to receive OTLP data and export it to an external backend looks like this:

Start the Collector, pointing it to your configuration file.

Set an environment variable in your application's host environment:

• OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318 (as you will be running the collector locally over HTTP).

The application will now generate telemetry and send it to Onum.

Onum Setup

Click Create listener when you're done.

Overview

Get system logs using the OKTA API.

Configuration

Parameters

• parameters.mydomain will store the value of the API URL, excluding the endpoint paths like or /api/v1/logs

Secrets

• Auth Token (OktaAuthorization)

To add a Secret, open the Secret fields and click New secret:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the OKTA System Log fields, or simply paste the given YAML:

This HTTP Pull Listener now uses the data export API to extract events.

Click Create labels to move on to the next step and define the required if needed.

Overview

The Anonymizer Action modifies sensitive data to remove or mask personally identifiable information, ensuring privacy.

Ports

These are the input and output ports of this Action:

Configuration

Example

Let's say we have a list of IPs we wish to anonymize in one of our events fields. To do it:

This is how your data will be transformed:

Overview

Get a list of the domains for the currently-scoped Organization.

Configuration

Overview

Where the vendor is Fortinet, it's product is Fortirecon. For Fortirecon, right now we have the following product types/endpoints:

• Accounts

Overview

Get a list of all audit logs. Retrieves paginated audit logs based on the provided filter criteria.

Configuration

Overview

Get a list of observed attack techniques. This endpoint is used to retrieve detailed attack activity observed across the environment and map it to the MITRE ATT&CK framework.

• The response contains an array of activities under the items field.

Trendmicro uses nextLink-based pagination for the /oat endpoint. NextLink-based pagination relies on a link (nextLink) that gives the link for the next call. Each API response contains a nextLink field.

Overview

List of the descendant Organizations for the currently-scoped Organization.

Configuration

Overview

Get a list of all threats. This endpoint is used to retrieve audit and threat logs.

• The response contains an array of activities under the data field.

SentinelOne uses cursor-based pagination for the /threats endpoint. Cursor-based pagination relies on a pointer (cursor) that refers to the next set of results. Each API response contains a nextCursor field. You pass that cursor value in your next request using the cursor query parameter to get the next page. For that reason, we define, pagination as cursor and we should define an initialRequest and a nextRequest under collection.

Get a list of all Reputation logs in Guardicore.

Configuration

Parameters

Get a list of all connections to Guardicore.

Configuration

Parameters

Overview

Get a list of all or filtered alerts. The alerts listed are what remains after alert exclusions are applied by Cortex XDR.

• Response is concatenated using AND condition (OR is not supported).

Overview

Onum supports integration wit .

The

Overview

Get a list of all activities. This endpoint is used to retrieve audit and activity logs related to users, agents, threats, policies, etc.

• The response contains an array of activities under the data field.

SentinelOne uses cursor-based pagination for the /activities endpoint. Cursor-based pagination relies on a pointer (cursor) that refers to the next set of results. Each API response contains a nextCursor field. You pass that cursor value in your next request using the cursor query parameter to get the next page. For that reason, we define, pagination as cursor and we should define an initialRequest and a nextRequest under collection.

Overview

The Action Assistant is an AI-powered chat feature designed to help users configure their within a

Overview

The For Each action divides a list field with different entries into different output events, along with the position they occupy in the list (being the first position 0

Overview

is a powerful in-memory data structure store that can be used as a database, cache, and message broker. It provides high performance, scalability, and versatility, making it a popular choice for real-time applications and data processing.