Skip to main content

OneTrust

Visualize OneTrust users, groups, risk, and vendors, and monitor changes through queries and alerts.

Installation​

Requirements​

  • An active OneTrust account with API access.
  • A OneTrust user who can create OAuth 2.0 client credentials in Global Settings.
  • Permission in JupiterOne to install new integrations.
note

Client credentials are assigned to the organization in which they are created, and calls made with those credentials only return objects accessible to that organizational group. Create the credentials in the organization whose data you want to ingest (typically the root or Global organization).

Configuration in OneTrust​

Generate OAuth 2.0 Client Credentials and collect Host URL​

  1. Log in to your OneTrust account.
  2. Click the gear icon in the upper-right corner to access Global Settings.
  3. Open the Client credentials screen, then click Add.
  4. Enter a Name for the client credential. The name cannot be changed later.
  5. (Optional) Enter a Description.
  6. Set the Access token lifetime. Any option works because the integration refreshes the token automatically; 1 Hour is a safe default.
  7. (Optional) Enable Restrict IP addresses to limit incoming communication to specific IP addresses. If enabled, enter the allowed addresses.
  8. Click Next. The Scope section appears.
  9. Select the scopes the integration requires:
    • SCIM — fetches user and group data.
    • RISK_READ — fetches risk data.
    • INVENTORY_READ — fetches vendor data.
  10. Click Create. The Client ID and Client Secret section appears.
  11. Click Download to save the .txt file containing your Client ID and Client Secret to a secure location, then click Close.
  12. Note your OneTrust Host URL from the browser address bar, for example https://customer.my.onetrust.com.

Configuration in JupiterOne​

  1. From the top navigation of the J1 Search homepage, select Integrations.
  2. Search for OneTrust and select it.
  3. Click on the Add Instance button and configure the following settings:
  • Enter the OneTrust Host — the host URL of your OneTrust portal, for example https://customer.my.onetrust.com.
  • Enter the Client ID generated in the OneTrust portal.
  • Enter the Client Secret generated in the OneTrust portal. This value is stored securely.
  • Enter the Account Name by which you'd like to identify this OneTrust instance in JupiterOne. Ingested entities will have this value stored in tag.AccountName when Tag with Account Name is checked.
  • Enter a Description to help your team identify the integration instance.
  • Select a Polling Interval that fits your monitoring needs. You may leave this as DISABLED and manually execute the integration.
  1. Click Create Instance once all values are provided.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.