Knowledge BaseRelease NotesRequest Demo

Dropbox Logs

Connecting Dropbox logs to your Panther Console

Overview

Panther has the ability to fetch Dropbox events by querying the Dropbox Business API. Panther will specifically monitor the following Dropbox team events:

  • User logging in or out of Dropbox (including device information)

  • Changing a user's role in Dropbox

  • Adding, editing, viewing, and sharing files and folders and by whom

  • Creating and sharing links within your team

Prerequisites

The Dropbox user authorizing this integration must have the "Team Admin" role credentials.

How to onboard Dropbox logs to Panther

Step 1: Create a new Dropbox log source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Select Dropbox from the list of available log sources.

  4. Click Start Source Setup.

  5. Enter a name for the source e.g., My Dropbox logs.

  6. Click Setup.

  7. On the "Set Credentials" page, copy the URL provided and store it in a secure location. You will need this in the next steps.

Step 2: Create a new app in Dropbox

  1. In a separate browser tab or window, log in to your business Dropbox account and navigate to the Dropbox app console.

  2. Click Create App.

  3. On the "Create a new app on the DBX Platform" page, fill out the fields:

    • Choose an API: Select Scoped Access.

    • Choose the type of access you need: Select Full Dropbox.

    • Name your app: Enter a descriptive name for your application.

    • Click Create app. The top of the image has a header that says "Create a new app on the DBX Platform." Under "1. Choose an API" the option "Scoped access" is selected. Under "2. Choose the type of access you need," the option "Full Dropbox" is selected. Under "3. Name your app" there is a field to enter a name.

  4. When you are redirected to the app Settings panel, paste in the Redirect URI that you copied from the Panther Console earlier in this documentation, and click Add next to it.

  5. Navigate to the Permissions tab at the top of the page.

  6. Under the "Team Scopes" section, check the boxes next to team_data.member and events.read. The "Team Data" section in Dropbox displays the permission options. The boxes are checked next to "team_data.member" and "events.read".

  7. Click Submit in the bar at the bottom of the page.

  8. Navigate back to the Settings tab at the top of the page.

  9. On the Settings tab, copy the App Key and App Secret values and store them in a secure location. You will need these in the next steps.

Step 3: Finalize the log source in Panther

  1. Navigate back to the Panther Console on the "Set Credentials" page where you left off in the earlier steps.

  2. Paste your App Key from Dropbox into the Client ID field.

  3. Paste your App Secret from Dropbox into the Client Secret field.

  4. Click Setup.

  5. On the "Verify Setup" page, click Grant Access.

    • You will be redirected to a Dropbox page to install your app.

  6. Click Allow.

  7. In Panther, you will be directed to a success screen:

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

Supported log types

Required fields in the schema are listed as "required: true" just below the "name" field.

Dropbox.TeamEvent

Contains events for an entire team's activity and provides information about how your team is using Dropbox.

For more information, see Dropbox Documentation on Team Log Events.

PreviousDocker Logs (Beta)NextDuo Security Logs

Last updated

Was this helpful?