Configuring Omnissa Security Events Service

Omnissa Security Events Service is a platform service that integrates the Omnissa platform with third-party identity and security products to exchange security events using the OpenID Shared Signals Framework (SSF) and its Continuous Access Evaluation Profile (CAEP) protocol. You can configure the service to transmit a continuous flow of real-time security event updates from Omnissa services, allowing integrated third-party products to take appropriate security measures based on the events. You can also configure the service to receive real-time security events from third-party products.

The Security Events Service supports transmitting CAEP Device Compliance Change events from Workspace ONE UEM. These events are generated whenever a device's compliance status changes, for example, if it becomes non-compliant due to a security policy violation. A receiver of the events can take action such as restricting access to corporate resources from the device.

The Security Events Service also supports transmitting CAEP Session Revoked and Credential Change events from Omnissa Access. Events are generated whenever a user is disabled or a user's credential changes. A receiver of the events can act upon the information, for example, by immediately terminating access for a user whose credentials changed.

Similarly, security events generated by integrated third-party identity or security products can be received by the Security Events Service.

Supported Features

The Security Events Service currently supports:

• Transmitting Device Compliance Change events from Workspace ONE UEM to supported subscribers
• Transmitting Session Revoked and Credential Change events from Omnissa Access to supported subscribers
• Configuring any third-party product that implements CAEP as a subscriber
  The integration has been tested with Apple, Okta, Google, Thales, SGNL, and SailPoint.
• Receiving CAEP events from Okta or any third-party product that implements CAEP

Requirements

• Required Omnissa services:

  • Omnissa Connect
  • Omnissa Intelligence
  • Workspace ONE UEM (to send Device Compliance Change events)
  • Omnissa Access Cloud (to send Session Revoked and Credential Change events)

  All the services must be part of the same organization in Omnissa Connect.

• Licensing requirements: Configuring incoming event subscriptions requires the Risk Analytics add-on license. The license is required to configure or update an external source or receive incoming events.

Concepts

The OpenID Shared Signals Framework (SSF) uses the concept of transmitters, receivers, and events to send and receive signals between trusted partners. The Omnissa Security Events Service has the following corresponding elements:

• Transmitter: As the transmitter, the Security Events Service transmits security events to subscribers.
• Receiver: As the receiver, the Security Events Service receives security events from third-party products, such as Okta.
• Source: Sources are Omnissa services, such as Workspace ONE UEM and Omnissa Access, or third-party identity and security products, such as Okta, that generate security events.
• Subscriber: Subscribers receive security events transmitted by the Security Events Service and take appropriate action based on them.
• Events: Events are CAEP events defined in the SSF standard. Each source supports a specific set of events.