Where this collector family fits
Identity collectors bring authentication, administrative, and account activity into the same investigation context as alerts, assets, and threat information. They are useful when identity behavior and access decisions are central to the evaluation.
- Authentication review
- Administrative change review
- Account-risk investigation
- Identity behavior context
Supported collectors in this family
Nova currently implements 6 collectors in this family. Each entry names the source and the customer outcome it supports.
- Auth0 Tenant Logs
- Brings Auth0 Tenant Logs activity into Nova for identity monitoring, access investigation, and account-risk analysis.
- CyberArk PAS Audit
- Brings CyberArk PAS Audit activity into Nova for identity monitoring, access investigation, and account-risk analysis.
- Duo Authentication Logs
- Brings Duo Authentication Logs activity into Nova for identity monitoring, access investigation, and account-risk analysis.
- Okta Identity Assets
- Keeps Okta Identity Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Okta System Logs
- Brings Okta System Logs activity into Nova for identity monitoring, access investigation, and account-risk analysis.
- OneLogin Events
- Brings OneLogin Events activity into Nova for identity monitoring, access investigation, and account-risk analysis.
How the evidence supports customer work
Nova keeps collected data linked to its source as it is used for asset inventory, cloud security, detection, investigation or Threat Hunting. Collecting data does not by itself prove a threat or authorize a response action.
Source coverage is not assumed to be complete. Nova keeps collection health, freshness, gaps, and partial results visible so teams can judge whether the evidence is suitable for the decision at hand.
Questions to answer during evaluation
- Which named sources are required for the use case, and which are optional context?
- What history, accounts, subscriptions, organizations, projects, or devices are available to the source product?
- What delay, volume, and missing-data conditions are acceptable for the intended decision?
- Which customer team owns source access, data interpretation, and ongoing health review?