Română
Português
EspañolConnecting cloud accounts and SaaS
Servers are under Fleet; cloud accounts and SaaS services are under Cloud Resources. Each is connected read-only, through its own audit log, so the monitoring can see who signed in and what changed without being able to change anything.
How connecting works
- Step 1
Choose Connect a resource
In Cloud resources, choose Connect a resource and the provider.
- Step 2
Create read-only access on the provider's side
The form shows exactly which permission to grant (below). Grant only that.
- Step 3
Paste the identifiers and the secret
Where a single call can prove the credentials (GitHub, Okta, Microsoft 365, Azure), the portal tests them as you save and tells you what the provider answered.
- Step 4
Collection is switched on
Saving opens a request to our team, who switch collection on. The resource shows Reporting when its first events arrive.
What each provider needs
| Provider | Access to create | What is read |
|---|---|---|
| Amazon Web Services | An IAM user with the managed policy SecurityAudit and read access to the CloudTrail bucket. | CloudTrail, GuardDuty findings |
| Microsoft Azure | An Entra ID app registration with Reader on the subscription and Graph AuditLog.Read.All. | Activity log, Entra ID sign-ins |
| Google Cloud | A log sink to Pub/Sub and a service account with roles/pubsub.subscriber on the subscription. | Cloud Audit Logs |
| Microsoft 365 | An Entra ID app with Office 365 Management APIs ActivityFeed.Read; unified audit logging on. | Exchange, SharePoint and Entra audit |
| Google Workspace | A service account with domain-wide delegation for the Reports audit scope (read-only). | Admin, sign-in and Drive activity |
| Okta | An API token created by a Read-Only Administrator. | System Log: sign-ins, MFA, admin changes |
| GitHub | A token with read access to the organisation's audit log. | Organisation audit log |
Other providers can be added on request: write to support@totuldigital.com.
Reading the Cloud resources screen
| Status | Meaning |
|---|---|
| Reporting | Events arrived recently. |
| Delayed | Events are arriving, but later than usual. Some providers publish audit logs with a delay of up to an hour. |
| Not reporting | Nothing has arrived for a while: the credentials may have expired or been revoked. |
| Waiting | Saved; collection is being switched on. |
Each resource shows its event volume over 24 hours and its findings by severity. Its events are in Events under the source Cloud, SaaS & PaaS.
Related
Still stuck?
Write to us with what you tried and what you saw. A person answers, in writing, on business days.