MENU
    IT Glue
    • 12 Jun 2025
    • 3 Minutes to read
    • Dark

    IT Glue

    • Dark

    Article summary

    Overview

    This Adapter allows you to connect to IT Glue to fetch activity logs.

    Deployment Configurations

    All adapters support the same client_options, which you should always specify if using the binary adapter or creating a webhook adapter. If you use any of the Adapter helpers in the web app, you will not need to specify these values.

    • client_options.identity.oid: the LimaCharlie Organization ID (OID) this adapter is used with.
    • client_options.identity.installation_key: the LimaCharlie Installation Key this adapter should use to identify with LimaCharlie.
    • client_options.platform: the type of data ingested through this adapter, like text, json, gcp, carbon_black, etc.
    • client_options.sensor_seed_key: an arbitrary name for this adapter which Sensor IDs (SID) are generated from, see below.

    Adapter-specific Options

    Adapter Type: itglue

    • token: your API key/token for IT Glue

    Infrastructure as Code Deployment

    # Adapter Documentation: https://docs.limacharlie.io/docs/adapter-types
    
    sensor_type: "itglue"
    itglue:
      token: "YOUR_ITGLUE_API_KEY_OR_TOKEN_HERE" # (required) your API key/token for IT Glue. Store securely.
      client_options:
        identity:
          oid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # (required) Organization ID from LimaCharlie.
          installation_key: "YOUR_LC_INSTALLATION_KEY_ITGLUE" # (required) Installation key associated with the OID.
        # Option 1: Static hostname for this sensor
        hostname: "itglue-adapter-prod-01.example.com" # (required if not using sensor_hostname_path) A unique, static hostname for this sensor instance.
        # Option 2: Dynamic hostname (see client_options.mapping.sensor_hostname_path below)
        platform: "saas_api" # (required) Indicates the source is a SaaS API.
        architecture: null # (optional) Not typically applicable for SaaS API integrations.
        mapping:
          # IT Glue API likely returns structured JSON, so parsing_re is often null.
          # Adjust if specific text parsing is needed from a field within the JSON.
          parsing_re: null
          # (optional) JSON path from IT Glue event data to uniquely ID the original configuration item, audit log, etc.
          sensor_key_path: "data.id" # Example: if events have a unique 'id' in a 'data' object.
          # (optional) If client_options.hostname is NOT set, use this to dynamically extract hostname from event.
          sensor_hostname_path: null # Example: "data.attributes.device_name" (if IT Glue events contain such a field).
          # (optional) Example: "ITGLUE_AUDIT_CONFIG_UPDATE", "ITGLUE_USER_LOGIN" based on a field in the event.
          event_type_path: "ITGLUE_{{ .data.type | token | upper | default \"GENERIC_EVENT\" }}"
          # (optional) JSON path to the field representing the event's occurrence time.
          event_time_path: "data.attributes.created_at" # Example: common timestamp field name.
          # (optional) JSON path for a field to populate LimaCharlie's investigation_id.
          investigation_id_path: "meta.request_id" # Example: if IT Glue API responses include a request ID.
          # (optional) Use +/- syntax for transforms: +new_field: 'template', -old_field: null
          transform:
            "+data_source_name": "ITGlue_Audit" # Add a static field for easier identification
            "+itglue_organization_id": "{{ .data.relationships.organization.data.id }}" # Example: extract related org ID
            "-meta.internal_notes": null # Remove a field not needed for telemetry
            # "+user_performing_action_email": "{{ .included[?(@.type=='users' && @.id==.data.relationships.user.data.id)].attributes.email }}" # Example of complex lookup if data is structured with 'included' resources
            # (optional) A list of field paths to drop from the event before sending to LimaCharlie.
          drop_fields:
          - "data.attributes.verbose_description"
          - "relationships.temporary_tokens"
          sid_replication_path: null # (optional) Not typically relevant for IT Glue events.
        # mappings: null # Deprecated or less common for field manipulation than client_options.mapping.transform
        indexing:
          enabled: true
          default_index: "itglue-audit-{{ .identity.oid | substr 0 8 }}" # Example: index by org prefix
        is_compressed: false # (optional) API responses are typically not compressed at this layer.
        sensor_seed_key: "SEED_KEY_ITGLUE_ADAPTER_001" # (required) A unique key for this sensor to register with LimaCharlie.
        dest_url: "https://input.limacharlie.io" # (optional) The destination URL. Usually defaults correctly.
    YAML

    API Doc

    See the official documentation.


    Was this article helpful?

    What's Next