I'm looking to set up ingestion so that user activity logs / audit logs from Workday are ingested into SecOps SIEM.
The documentation on the SecOps site is proving vague and somewhat contradictory. Workday is supported as an `API` (Third Party API) source type for ingestion, and the documentation is clear that this will enable ingestion of Workday entity context (`WORKDAY` log type).
However, I can't find a definitive answer for if we can ingest Workday audit logs (`WORKDAY_AUDIT`) or Workday user activity logs (`WORKDAY_USER_ACTIVITY`) via API, or if we will have to set up an ingestion mechanism. The Feed Management API documentation seems to suggest that it is supported but without a default parser, which contradicts Supported log types and default parsers which shows that there is a default parser. Additionally, the section of the Feed Management API documentation for Workday shows that it only hits API endpoints related to user entities, not activity logs.
Does anyone have Workday audit/activity logs being ingested as a Third Party API source, or has attempted this and found it doesn't work?
