Zoom Logs
Panther supports pulling logs directly from Zoom
Overview
Panther can fetch Zoom operational and activity logs by querying various Zoom API endpoints. Panther can specifically monitor the following Zoom events:
Changes to Account and Group settings
Changes in role and license assignments for users
Changes to subscriptions under Billing
Changes made to SSO configuration, including changes made by your SSO and SAML mapping configuration
How to onboard Zoom logs to Panther
To set up this integration, you will create an OAuth2 app in your Zoom account and configure Zoom as a log source in your Panther Console.
Prerequisite
While logged in to Zoom as a user with the Admin role, go to the Zoom roles page and verify that your Zoom user account (to be used later in Step 2) has the following required permissions:
The
Usage reports
view permission.The
Sign In/Sign Out
view permission.This is required if you are fetching Zoom.Activity logs.
The
Admin Activity Logs
view permission.
Step 1: Create a new Zoom log source in Panther
In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Select Zoom from the list of available log sources. Click Start Setup.
On the next screen, enter a descriptive name for the source e.g.
My Zoom logs
.Click Setup.
Copy the Redirect URL from Panther and save it in a secure location. You will need this in the next steps when you create an OAuth2 App in Zoom.
Keep this browser window open, as you will need to complete additional configuration in the next steps.
Step 2: Create a new OAuth2 app in Zoom
Follow the Zoom documentation on how to create an OAuth app.
Step 3: Finish setup in Panther
In the Panther Console, on the Set Credentials page, enter the Client ID and the Client Secret that you obtained from Zoom, and click Setup.
Click Grant Access to grant Panther access to your Zoom logs.
You will be directed to a success screen:
You can optionally enable one or more Detection Packs.
The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.
Panther-Built Detections
See Panther's built in rules for Zoom in panther-analysis in Github.
Supported log types
Zoom.Activity
Sign in/sign out activity logs of users under a Zoom account.
Reference: Zoom Documentation on Sign In Sign Out Reports.
Zoom.Operation
The report allows you to audit admin and user activity, such as adding a new user, changing account settings, and deleting recordings.
Reference: Zoom Documentation on Operation Log Reports.
Last updated