SailPointIdentityIQ

SailPoint IdentityIQ context pack enables XSOAR customers to utilize the deep, enriched contextual data in the SailPoint predictive identity platform to better drive identity-aware security practices.

Identity and Access Management · SailPoint IdentityIQ

Details

IDSailPointIdentityIQ
ProviderSailPoint Technologies
CategoryIdentity and Access Management
From Version6.0.0
Docker Imagedemisto/python3:3.12.14.12277297
Supported ModulesAgentix XSIAM Cloud Posture Security EDR Cortex Cloud Cloud Runtime Security

README

SailPoint IdentityIQ context pack enables XSOAR customers to utilize the deep, enriched contextual data in the SailPoint predictive identity platform to better drive identity-aware security practices.
This integration was integrated and tested with version 8.1 of SailPoint IdentityIQ.
Supported Cortex XSOAR versions: 6.0.0 and later.

Configure SailPointIdentityIQ in Cortex

Parameter Description Required
identityiq_url IdentityIQ Server URL (e.g. https://identityiq-server.com/identityiq) True
client_id Client Id (for OAuth 2.0) True
client_secret Client Secret (for OAuth 2.0) True
isFetch Fetch incidents False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
incidentType Incident type False
max_fetch Maximum number of incidents per fetch False
first_fetch First fetch time False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

identityiq-search-identities

Search identities by search/filter parameters (id, email, risk & active) using IdentityIQ SCIM API’s.

Base Command

identityiq-search-identities

Input

Argument Name Description Required
id Internal id of the identity being requested. Optional
email Email address of the identity being requested. Optional
active Determines whether search will return only active identities. Default is true. Optional
risk Numeric value of baseline risk score, users above this will be returned. Optional

Context Output

Path Type Description
IdentityIQ.Identity.userName String The IdentityIQ username (primary id).
IdentityIQ.Identity.id String The IdentityIQ internal id (uuid).
IdentityIQ.Identity.name.formatted String The display name of the identity.
IdentityIQ.Identity.name.familyName String The last name of the identity.
IdentityIQ.Identity.name.givenName String The first name of the identity.
IdentityIQ.Identity.active Boolean Indicates whether the id is active or inactive in IdentityIQ.
IdentityIQ.Identity.manager.userName String The IdentityIQ username (primary id) of the identities manager.
IdentityIQ.Identity.lastModified Date Timestamp of when the identity was last modified.
IdentityIQ.Identity.displayName String The display name of the identity.
IdentityIQ.Identity.emails Unknown Array of email objects.
IdentityIQ.Identity.emails.type String Type of the email being returned.
IdentityIQ.Identity.emails.value String The email address of the identity.
IdentityIQ.Identity.emails.primary Boolean Indicates if this email address is the identities primary email.
IdentityIQ.Identity.entitlements Unknown Array of entitlements objects that the identity has.
IdentityIQ.Identity.roles Unknown Array of role objects that the identity has.
IdentityIQ.Identity.capabilities Unknown Array of string representations of the IdentityIQ capabilities assigned to this identity.

Command Examples

!identityiq-search-identities
!identityiq-search-identities id=8a8080824df45873014df45bd97400c9
!identityiq-search-identities email=jerry.bennett@sailpointdemo.com
!identityiq-search-identities active=False
!identityiq-search-identities risk=500
!identityiq-search-identities active=False risk=500

Human Readable Output

Results

Identity

id userName displayName name emails sailpointUser extendedUser entitlements roles capabilities active
8a8080824df45873014df45bd97400c9 Adam.Kennedy Adam Kennedy formatted: Adam Kennedy
familyName: Kennedy
givenName: Adam		 {‘type’: ‘work’, ‘value’: ‘Adam.Kennedy@sailpointdemo.com’, ‘primary’: True} capabilities:
lastRefresh: 2020-10-08T15:45:47.034-05:00
jobTitle: Payroll Analyst II
employeeId: 1b2c3a4e
administrator: {}
employeeType: Employee
phone: 5124152339
isManager: false
location: London
accounts: {‘displayName’: ‘1b2c3a4e’, ‘value’: ‘8a8080824df45873014df45bd97500ca’, ‘$ref’: ‘http://localhost:8088/iiq/scim/v2/Accounts/8a8080824df45873014df45bd97500ca’},
{‘displayName’: ‘Adam.Kennedy’, ‘value’: ‘8a8080824df45873014df45c164601d8’, ‘$ref’: ‘http://localhost:8088/iiq/scim/v2/Accounts/8a8080824df45873014df45c164601d8’},
{‘displayName’: ‘AKENNE’, ‘value’: ‘8a8080824df45873014df45d012705ae’, ‘$ref’: ‘http://localhost:8088/iiq/scim/v2/Accounts/8a8080824df45873014df45d012705ae’},
{‘displayName’: ‘Adam.Kennedy’, ‘value’: ‘8a8080824df45873014df45da06308b0’, ‘$ref’: ‘http://localhost:8088/iiq/scim/v2/Accounts/8a8080824df45873014df45da06308b0’}
riskScore: 82
department: Accounting
region: GB		 manager: {“displayName”: “Doug Testman”, “value”: “8a8080824df45873014df45bcfab008d”, “$ref”: “http://localhost:8088/iiq/scim/v2/Users/8a8080824df45873014df45bcfab008d”}       true

identityiq-get-policyviolations

Fetch policy violation by id or all policy violations using IdentityIQ SCIM API’s.

Base Command

identityiq-get-policyviolations

Input

Argument Name Description Required
id Internal id of the policy violation being requested. Optional

Context Output

Path Type Description
IdentityIQ.PolicyViolation.policyName String Name of the policy that was violated.
IdentityIQ.PolicyViolation.constraintName String Name of the constraint being violated.
IdentityIQ.PolicyViolation.status String Status of the violation (open/closed).
IdentityIQ.PolicyViolation.description String Description of the policy/conflict.
IdentityIQ.PolicyViolation.identity.value Unknown Internal id of the IdentityIQ identity in violation.
IdentityIQ.PolicyViolation.identity.displayName String Display name of the IdentityIQ identity in violation.
IdentityIQ.PolicyViolation.id String Internal id of the task result.

Command Example

!identityiq-get-policyviolations
!identityiq-get-policyviolations id=8a8080824df45873014df46036521328

Human Readable Output

Results

PolicyViolation

id policyName constraintName status description identity owner
8a8080824df45873014df46036521328 SOD Policy Accounts Payable Access-Accounts Receivable Access Accounts Payable Access - Accounts Receivable Access constraint Open   displayName: Frank Testson
value: 8a8080824df45873014df45bc8480065
$ref: http://localhost:8088/iiq/scim/v2/Users/8a8080824df45873014df45bc8480065		 displayName: Rick Testson
value: 8a8080824df45873014df45bbbb9002b
$ref: http://localhost:8088/iiq/scim/v2/Users/8a8080824df45873014df45bbbb9002b

identityiq-get-taskresults

Fetch task result by id or all task results using IdentityIQ SCIM API’s.

Base Command

identityiq-get-taskresults

Input

Argument Name Description Required
id Internal id of the task result being requested. Optional

Context Output

Path Type Description
IdentityIQ.TaskResult.id String Internal id of the task result.
IdentityIQ.TaskResult.progress String String representation of the status of the task.
IdentityIQ.TaskResult.launched Date Date representation of when the task was launched in IdentityIQ.
IdentityIQ.TaskResult.taskDefinition String Name of the task template that this task result is an instantiation of.
IdentityIQ.TaskResult.host String Host name of the IdentityIQ application server that is executing this task.
IdentityIQ.TaskResult.type String Type of the task being executed.
IdentityIQ.TaskResult.pendingSignoffs Number Number of signoffs on the task result that have not been done.
IdentityIQ.TaskResult.completionStatus String Status of task ‘success’, ‘termianted’, ‘failure’, etc.
IdentityIQ.TaskResult.launcher String Name of the IdentityIQ identity who launched the task.
IdentityIQ.TaskResult.name String Unique name of the task that was launched.
IdentityIQ.TaskResult.completed Date Timestamp of when the task was completed (if not currently executed).

Command Example

!identityiq-get-taskresults
!identityiq-get-taskresults id=0a0000016b951ded816bb41351e901b3

Human Readable Output

Results

TaskResult

id name type host progress completionStatus launched taskDefinition pendingSignoffs launcher completed taskSchedule partitioned terminated messages attributes
0a0000016b951ded816bb41351e901b3 Joiner: DannyFieldsPS Workflow     Success 2019-07-02T14:04:53.471-05:00 Workflow Launcher 0 Scheduler 2019-07-02T14:04:53.480-05:00   false false   {‘value’: ‘\n’, ‘key’: ‘workflowSummary’}

identityiq-get-accounts

Fetch accounts by search/filter parameters (id, display_name, last_refresh, native_identity, last_target_agg, identity_name & application_name) using IdentityIQ SCIM API’s.

Base Command

identityiq-get-accounts

Input

Argument Name Description Required
id Internal id of the account to be returned. Optional
display_name displayName of the account to be returned. Optional
last_refresh Timestamp of the last time the account(s) were refreshed from the target system.
[format : yyyy-MM-dd’T’HH:mm:ss or yyyy-MM-dd].		 Optional
native_identity Unique identifier of the account on the target system. Optional
last_target_agg Timestamp of the last targeted aggregation of the account from the target system.
[format : yyyy-MM-dd’T’HH:mm:ss or yyyy-MM-dd].		 Optional
identity_name Unique name of the identity for which all accounts will be returned. Optional
application_name Unique name of the application for which all accounts will be returned. Optional

Context Output

Path Type Description
IdentityIQ.Account.id String Internal id of the account.
IdentityIQ.Account.identity.value String Internal id of the identity that this account belongs to.
IdentityIQ.Account.identity.displayName String Display name of the identity that this account belongs to.
IdentityIQ.Account.hasEntitlements Boolean True if the account has access entitlements assigned to it, else false.
IdentityIQ.Account.application.value Unknown Internal id of the application that this account is on.
IdentityIQ.Account.application.displayName String Display name of the application that this account is on.
IdentityIQ.Account.nativeIdentity String The name of the account as it exists on the application.
IdentityIQ.Account.lastRefreshed Date Timestamp of when this account was last refreshed in IdentityIQ.

Command Example

!identityiq-get-accounts
!identityiq-get-accounts id=8a8080824df45873014df45bb504000e
!identityiq-get-accounts last_refresh=2020-10-05T15:53:46
!identityiq-get-accounts native_identity=1b2c
!identityiq-get-accounts last_target_agg=2020-10-05T15:53:46
!identityiq-get-accounts identity_name=Amanda.Ross
!identityiq-get-accounts application_name=TRAKK
!identityiq-get-accounts identity_name=Amanda.Ross application_name=TRAKK

Human Readable Output

Results

Account

id displayName identity hasEntitlements application nativeIdentity active lastRefresh manuallyCorrelated application locked
8a8080824df45873014df45bb504000e 1b displayName: Jerry Bennett
userName: Jerry.Bennett
value: 8a8080824df45873014df45bb503000d
$ref: http://localhost:8088/iiq/scim/v2/Users/8a8080824df45873014df45bb503000d		 false displayName: Human Resources
value: 8a8080824df44d48014df4542d7402aa
$ref: http://localhost:8088/iiq/scim/v2/Applications/8a8080824df44d48014df4542d7402aa		 1b true 2015-06-14T18:16:00.389-05:00 false displayName: Human Resources
value: 8a8080824df44d48014df4542d7402aa
$ref: http://localhost:8088/iiq/scim/v2/Applications/8a8080824df44d48014df4542d7402aa		 false

identityiq-disable-account

Disable account’s active status by id using IdentityIQ SCIM API’s.

Base Command

identityiq-disable-account

Input

Argument Name Description Required
id Internal id of the specific account to be disabled. Required

Context Output

Path Type Description
IdentityIQ.AccountDisable.active Boolean Indicates the status of account (should be false after request is successfully completed).

Command Example

!identityiq-disable-account id=8a8080824df45873014df45c719f038c

Human Readable Output

Results

Account

id displayName identity hasEntitlements application nativeIdentity active lastRefresh manuallyCorrelated application locked
8a8080824df45873014df45c719f038c Jerry.Bennett displayName: Jerry Bennett
userName: Jerry.Bennett
value: 8a8080824df45873014df45bb503000d
$ref: http://localhost:8088/iiq/scim/v2/Users/8a8080824df45873014df45bb503000d		 true displayName: Active Directory
value: 8a8080824df44d48014df45440d502cf
$ref: http://localhost:8088/iiq/scim/v2/Applications/8a8080824df44d48014df45440d502cf		 CN=Jerry Bennett,OU=Brussels,OU=Europe,OU=Demo,DC=seri,DC=sailpointdemo,DC=com false 2020-12-16T16:39:56.638-06:00 false displayName: Active Directory
value: 8a8080824df44d48014df45440d502cf
$ref: http://localhost:8088/iiq/scim/v2/Applications/8a8080824df44d48014df45440d502cf		 false

identityiq-enable-account

Enable account’s active status by id using IdentityIQ SCIM API’s.

Base Command

identityiq-enable-account

Input

Argument Name Description Required
id Internal id of the specific account to be enabled. Required

Context Output

Path Type Description
IdentityIQ.AccountDisable.active Boolean Indicates the status of account (should be true after request is successfully completed).

Command Example

!identityiq-enable-account id=8a8080824df45873014df45c719f038c

Human Readable Output

Results

Account

id displayName identity hasEntitlements application nativeIdentity active lastRefresh manuallyCorrelated application locked
8a8080824df45873014df45c719f038c Jerry.Bennett displayName: Jerry Bennett
userName: Jerry.Bennett
value: 8a8080824df45873014df45bb503000d
$ref: http://localhost:8088/iiq/scim/v2/Users/8a8080824df45873014df45bb503000d		 true displayName: Active Directory
value: 8a8080824df44d48014df45440d502cf
$ref: http://localhost:8088/iiq/scim/v2/Applications/8a8080824df44d48014df45440d502cf		 CN=Jerry Bennett,OU=Brussels,OU=Europe,OU=Demo,DC=seri,DC=sailpointdemo,DC=com true 2020-12-16T16:39:56.638-06:00 false displayName: Active Directory
value: 8a8080824df44d48014df45440d502cf
$ref: http://localhost:8088/iiq/scim/v2/Applications/8a8080824df44d48014df45440d502cf		 false

identityiq-delete-account

Delete account by id using IdentityIQ SCIM API’s.

Base Command

identityiq-delete-account

Input

Argument Name Description Required
id Internal id of the specific account to be deleted. Required

Context Output

There is no context output for this command.

Command Example

!identityiq-delete-account id=8a8080824df45873014df45bb335000c

Human Readable Output

Account deleted successfully!

identitytiq-get-launched-workflows

Fetch launched workflow by id or all launched workflows using IdentityIQ SCIM API’s.

Base Command

identitytiq-get-launched-workflows

Input

Argument Name Description Required
id Internal id of the specific launched workflow being requested. Optional

Context Output

Path Type Description
IdentityIQ.Workflow.workflowName String Name of the workflow that was launched.
IdentityIQ.Workflow.identityRequestId String Unique id of the identity request that launched this workflow (if exists).
IdentityIQ.Workflow.workflowCaseId String Internal id of the workflowcase for this workflow.
IdentityIQ.Workflow.launched Date Timestamp of when this workflow was launched.
IdentityIQ.Workflow.targetClass String Type of object targeted by the workflow, usually identity.
IdentityIQ.Workflow.targetName String Unique name of the object (username in the case of identity).
IdentityIQ.Workflow.type String The type of workflow.
IdentityIQ.Workflow.id String Internal id of the workflow.
IdentityIQ.Workflow.completionStatus String Status of workflow – ‘success’, ‘failure’, ‘pending’ etc.
IdentityIQ.Workflow.launcher String Name of the identity that launched the workflow.
IdentityIQ.Workflow.terminated Boolean Indicates whether this workflow was terminated due to error or intentionally stopped.
IdentityIQ.Workflow.name String Name of the workflow that was launched.
IdentityIQ.Workflow.attributes Unknown Array of key/value pairs that are the inputs and their values to the workflow.
IdentityIQ.Workflow.output Unknown Array of key/type/value objects that list the output of the workflow.

Command Example

!identitytiq-get-launched-workflows
!identitytiq-get-launched-workflows id=0a0000016b951ded816bb41348e20197

Human Readable Output

Results

Workflow

id name workflowName identityRequestId workflowCaseId launched targetClass targetName type completionStatus launcher terminated attributes partitioned completed pendingSignoffs taskDefinition launchedWorkflow
0a0000016b951ded816bb41348e20197 Joiner: Nick       2019-07-02T14:04:51.148-05:00     Workflow Success Scheduler false {‘value’: ‘\n’, ‘key’: ‘workflowSummary’} false 2019-07-02T14:04:51.169-05:00 0 Workflow Launcher output: {‘type’: ‘application/xml’, ‘value’: ‘\n’, ‘key’: ‘workflowSummary’}
input: {}
workflowSummary:

workflowName: Joiner: Nick

identityiq-get-roles

Fetch role by id or all roles using IdentityIQ SCIM API’s.

Base Command

identityiq-get-roles

Input

Argument Name Description Required
id Internal id of the specific role being requested. Optional

Context Output

Path Type Description
IdentityIQ.Role.name String Unique name of the role object in IdentityIQ.
IdentityIQ.Role.owner.value String Internal id of the role owner identity.
IdentityIQ.Role.owner.displayName String Displayname of the owner of the role.
IdentityIQ.Role.active Boolean Indicates whether the role is active in IdentityIQ.
IdentityIQ.Role.displayableName String Display name of the role in IdentityIQ.
IdentityIQ.Role.permits Unknown Array of roles that this role permits in IdentityIQ.
IdentityIQ.Role.type.name String Template role on which this role is based.
IdentityIQ.Role.type.autoAssignment Boolean Indicates whether this type of role can be auto-assigned to identities.
IdentityIQ.Role.type.displayName String Display name of the template role on which this role was based.
IdentityIQ.Role.type.manualAssignment String Indicates whether this role type can be manually assigned.
IdentityIQ.Role.descriptions.value String Description of the role shown in the UI.

Command Example

!identityiq-get-roles
!identityiq-get-roles id=8a8080824df45873014df45f8b6810e9

Human Readable Output

Results

Role

id name owner active displayableName permits type descriptions requirements
8a8080824df45873014df45f8b6810e9 All Users displayName: The Administrator
value: 8a8080824df44d48014df44def7100dd
$ref: http://localhost:8088/iiq/scim/v2/Users/8a8080824df44d48014df44def7100dd		 true All Users   iiq: false
requirements: true
permits: true
displayName: Business
manualAssignment: true
name: business
autoAssignment: true
assignmentSelector: true		 {‘locale’: ‘en_US’, ‘value’: ‘Role that grants access all users should have’} {‘displayName’: ‘User Basic’, ‘value’: ‘8a8080824df45873014df45f8b1810e6’, ‘$ref’: ‘http://localhost:8088/iiq/scim/v2/Roles/8a8080824df45873014df45f8b1810e6’}

identityiq-get-entitlements

Fetch entitlement by id or all entitlements using IdentityIQ SCIM API’s.

Base Command

identityiq-get-entitlements

Input

Argument Name Description Required
id Internal id of the specific entitlement being requested. Optional

Context Output

Path Type Description
IdentityIQ.Entitlement.application.value String Internal id of the application that this entitlement resides on.
IdentityIQ.Entitlement.application.displayName String Display name of the application that this entitlement resides on.
IdentityIQ.Entitlement.attribute String String representing the attribute on the application that this entitlement represents.
IdentityIQ.Entitlement.type String String representing the type of attribute on the application that this entitlement represents.
IdentityIQ.Entitlement.descriptions Unknown Array of description objects that contain a locale, and a value.
IdentityIQ.Entitlement.id String Internal id of the entitlement object in IdentityIQ.
IdentityIQ.Entitlement.requestable Boolean Boolean indicates whether this entitlement is directly requestable in the IdentityIQ UI.
IdentityIQ.Entitlement.owner.value String Internal id of the owner of the entitlement in IdentityIQ.
IdentityIQ.Entitlement.owner.displayName String Display name of the owner of the entitlement in IdentityIQ.
IdentityIQ.Entitlement.aggregated String Indicates whether this entitlement was aggregated from the source system or not.
IdentityIQ.Entitlement.created Date Timestamp indicates when the entitlement was created in IdentityIQ.

Command Example

!identityiq-get-entitlements
!identityiq-get-entitlements id=8a8080824df45873014df45d9f9008a8

Human Readable Output

Results

Entitlement

id displayableName type attribute value owner application descriptions requestable aggregated created
8a8080824df45873014df45d9f9008a8 input Entitlement capability input   displayName: TRAKK
value: 8a8080824df44d48014df45444c002da
$ref: http://localhost:8088/iiq/scim/v2/Applications/8a8080824df44d48014df45444c002da		   true false  

identityiq-get-alerts

Fetch alert by id or all alerts using IdentityIQ SCIM API’s.

Base Command

identityiq-get-alerts

Input

Argument Name Description Required
id Internal id of the specific alert being requested. Optional

Context Output

Path Type Description
IdentityIQ.Alert.id String Internal id of the Alert in IdentityIQ.
IdentityIQ.Alert.lastProcessed Date Timestamp of when this alert was processed by IdentityIQ for match.
IdentityIQ.Alert.displayName String Display name of the alert in IdentityIQ.
IdentityIQ.Alert.meta.created Date Timestamp of when this alert was created in IdentityIQ
IdentityIQ.Alert.name String Name of the alert in IdentityIQ
IdentityIQ.Alert.attributes Unknown Array of attributes associated with this alert.
IdentityIQ.Alert.actions Unknown Array of actions taken on this alert after processing.
IdentityIQ.Alert.application String List of applications that are related to this alert.

Command Example

!identityiq-get-alerts
!identityiq-get-alerts id=0a000001764519c981766dbd2bd518ad

Human Readable Output

Results

Alert

id name displayName type targetId targetDisplayName targetType alertInput actions application attributes lastProcessed
0a000001764519c981766dbd2bd518ad 0000000015 Test Alert PAN XSOAR       input:
processorTaskInput:
aggregationTaskInput:		       2020-12-16T16:48:02.773-06:00

identityiq-create-alert

Create an alert using IdentityIQ SCIM API’s.

Base Command

identityiq-create-alert

Input

Argument Name Description Required
display_name Display name of the alert. Required
attributes List of JSON objects with the following structure.
{
‘key’: ‘’,
‘value’: ‘’,
‘type’: ‘‘
}.		 Optional

Context Output

Path Type Description
IdentityIQ.Alert.id String Internal id of the Alert in IdentityIQ.
IdentityIQ.Alert.lastProcessed Date Timestamp of when this alert was processed by IdentityIQ for match.
IdentityIQ.Alert.displayName String Display name of the alert in IdentityIQ.
IdentityIQ.Alert.meta.created Date Timestamp of when this alert.
IdentityIQ.Alert.name String Unique name of the alert in IdentityIQ.
IdentityIQ.Alert.attributes Unknown Array of attributes associated with this alert.
IdentityIQ.Alert.actions Unknown Array of actions taken on this alert after processing.
IdentityIQ.Alert.application String List of applications that are related to this alert.

Command Example

!identityiq-create-alert display_name=Testing-Via-XSOAR

Human Readable Output

Results

Alert

id name displayName type targetId targetDisplayName targetType alertInput actions application attributes lastProcessed
0a000001764519c981767209e7491c04 0000000016 XSOAR-Alert PAN XSOAR       input:
processorTaskInput:
aggregationTaskInput:		       2020-12-17T12:50:20.369-06:00

Configuration parameters

  • identityiq_url — IdentityIQ Server URL (e.g. https://identityiq-server.com/identityiq) (required)
  • client_id — Client Id (for OAuth 2.0) (required)
  • client_secret — Client Secret (for OAuth 2.0) (required)
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time
  • incidentFetchInterval — Incidents Fetch Interval

Commands (12)

  • identityiq-create-alert

    Create an alert using IdentityIQ SCIM API's.

  • identityiq-delete-account

    Delete account by id using IdentityIQ SCIM API's.

  • identityiq-disable-account

    Disable account's active status by id using IdentityIQ SCIM API's.

  • identityiq-enable-account

    Enable account's active status by id using IdentityIQ SCIM API's.

  • identityiq-get-accounts

    Fetch accounts by search/filter parameters (id, display_name, last_refresh, native_identity, last_target_agg, identity_name & application_name) using IdentityIQ SCIM API's.

  • identityiq-get-alerts

    Fetch alert by id or all alerts using IdentityIQ SCIM API's.

  • identityiq-get-entitlements

    Fetch entitlement by id or all entitlements using IdentityIQ SCIM API's.

  • identityiq-get-policyviolations

    Fetch policy violation by id or all policy violations using IdentityIQ SCIM API's.

  • identityiq-get-roles

    Fetch role by id or all roles using IdentityIQ SCIM API's.

  • identityiq-get-taskresults

    Fetch task result by id or all task results using IdentityIQ SCIM API's.

  • identityiq-search-identities

    Search identities by search/filter parameters (id, email, risk & active) using IdentityIQ SCIM API's.

  • identitytiq-get-launched-workflows

    Fetch launched workflow by id or all launched workflows using IdentityIQ SCIM API's.

Source

SailPointIdentityIQ.py SailPointIdentityIQ_test.py SailPointIdentityIQ.yml SailPointIdentityIQ_description.md command_examples.txt
Download History Raw 
category: Identity and Access Management
provider: SailPoint Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: SailPointIdentityIQ
  version: -1
configuration:
- additionalinfo: The FQDN/IP of the IdentityIQ server to connect
  display: IdentityIQ Server URL (e.g. https://identityiq-server.com/identityiq)
  name: identityiq_url
  required: true
  type: 12
  section: Connect
- additionalinfo: Client Id for OAuth 2.0
  display: Client Id (for OAuth 2.0)
  name: client_id
  required: true
  type: 4
  section: Connect
- additionalinfo: Client Secret for OAuth 2.0
  display: Client Secret (for OAuth 2.0)
  name: client_secret
  required: true
  type: 4
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '50'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
description: SailPoint IdentityIQ context pack enables XSOAR customers to utilize the deep, enriched contextual data in the SailPoint predictive identity platform to better drive identity-aware security practices.
display: SailPoint IdentityIQ
name: SailPointIdentityIQ
script:
  commands:
  - arguments:
    - description: Internal id of the identity being requested.
      name: id
    - description: Email address of the identity being requested.
      name: email
    - defaultValue: 'true'
      description: Determines whether search will return only active identities.
      name: active
    - description: Numeric value of baseline risk score, users above this will be returned.
      name: risk
    - description: Use custom filter to find user in IIQ. Filter should be like `userName co "ACTIVE_DIRECTORY_" and userName co "<USER-NAME>" and active eq true and userType eq "Service"` or `emails.value eq "example@example.com" and active eq true and userType eq "person"`. Note that if you use this argument to filter then the other argument filters will not be taken into account in the search filter.
      name: filter
    description: Search identities by search/filter parameters (id, email, risk & active) using IdentityIQ SCIM API's.
    name: identityiq-search-identities
    outputs:
    - contextPath: IdentityIQ.Identity.userName
      description: The IdentityIQ username (primary id).
      type: String
    - contextPath: IdentityIQ.Identity.id
      description: The IdentityIQ internal id (uuid).
      type: String
    - contextPath: IdentityIQ.Identity.name.formatted
      description: The display name of the identity.
      type: String
    - contextPath: IdentityIQ.Identity.name.familyName
      description: The last name of the identity.
      type: String
    - contextPath: IdentityIQ.Identity.name.givenName
      description: The first name of the identity.
      type: String
    - contextPath: IdentityIQ.Identity.active
      description: Indicates whether the id is active or inactive in IdentityIQ.
      type: Boolean
    - contextPath: IdentityIQ.Identity.manager.userName
      description: The IdentityIQ username (primary id) of the identities manager.
      type: String
    - contextPath: IdentityIQ.Identity.lastModified
      description: Timestamp of when the identity was last modified.
      type: Date
    - contextPath: IdentityIQ.Identity.displayName
      description: The display name of the identity.
      type: String
    - contextPath: IdentityIQ.Identity.emails
      description: Array of email objects.
      type: Unknown
    - contextPath: IdentityIQ.Identity.emails.type
      description: Type of the email being returned.
      type: String
    - contextPath: IdentityIQ.Identity.emails.value
      description: The email address of the identity.
      type: String
    - contextPath: IdentityIQ.Identity.emails.primary
      description: Indicates if this email address is the identities primary email.
      type: Boolean
    - contextPath: IdentityIQ.Identity.entitlements
      description: Array of entitlements objects that the identity has.
      type: Unknown
    - contextPath: IdentityIQ.Identity.roles
      description: Array of role objects that the identity has.
      type: Unknown
    - contextPath: IdentityIQ.Identity.capabilities
      description: Array of string representations of the IdentityIQ capabilities assigned to this identity.
      type: Unknown
  - arguments:
    - description: Internal id of the policy violation being requested.
      name: id
    description: Fetch policy violation by id or all policy violations using IdentityIQ SCIM API's.
    name: identityiq-get-policyviolations
    outputs:
    - contextPath: IdentityIQ.PolicyViolation.policyName
      description: Name of the policy that was violated.
      type: String
    - contextPath: IdentityIQ.PolicyViolation.constraintName
      description: Name of the constraint being violated.
      type: String
    - contextPath: IdentityIQ.PolicyViolation.status
      description: Status of the violation (open/closed).
      type: String
    - contextPath: IdentityIQ.PolicyViolation.description
      description: Description of the policy/conflict.
      type: String
    - contextPath: IdentityIQ.PolicyViolation.identity.value
      description: Internal id of the IdentityIQ identity in violation.
      type: Unknown
    - contextPath: IdentityIQ.PolicyViolation.identity.displayName
      description: Display name of the IdentityIQ identity in violation.
      type: String
    - contextPath: IdentityIQ.PolicyViolation.id
      description: Internal id of the task result.
      type: String
  - arguments:
    - description: Internal id of the task result being requested.
      name: id
    description: Fetch task result by id or all task results using IdentityIQ SCIM API's.
    name: identityiq-get-taskresults
    outputs:
    - contextPath: IdentityIQ.TaskResult.id
      description: Internal id of the task result.
      type: String
    - contextPath: IdentityIQ.TaskResult.progress
      description: String representation of the status of the task.
      type: String
    - contextPath: IdentityIQ.TaskResult.launched
      description: Date representation of when the task was launched in IdentityIQ.
      type: Date
    - contextPath: IdentityIQ.TaskResult.taskDefinition
      description: Name of the task template that this task result is an instantiation of.
      type: String
    - contextPath: IdentityIQ.TaskResult.host
      description: Host name of the IdentityIQ application server that is executing this task.
      type: String
    - contextPath: IdentityIQ.TaskResult.type
      description: Type of the task being executed.
      type: String
    - contextPath: IdentityIQ.TaskResult.pendingSignoffs
      description: Number of signoffs on the task result that have not been done.
      type: Number
    - contextPath: IdentityIQ.TaskResult.completionStatus
      description: Status of task 'success', 'termianted', 'failure', etc.
      type: String
    - contextPath: IdentityIQ.TaskResult.launcher
      description: Name of the IdentityIQ identity who launched the task.
      type: String
    - contextPath: IdentityIQ.TaskResult.name
      description: Unique name of the task that was launched.
      type: String
    - contextPath: IdentityIQ.TaskResult.completed
      description: Timestamp of when the task was completed (if not currently executed).
      type: Date
  - arguments:
    - description: Internal id of the account to be returned.
      name: id
    - description: displayName of the account to be returned.
      name: display_name
    - description: |-
        Timestamp of the last time the account(s) were refreshed from the target system.
        [format : yyyy-MM-dd'T'HH:mm:ss or yyyy-MM-dd].
      name: last_refresh
    - description: Unique identifier of the account on the target system.
      name: native_identity
    - description: |-
        Timestamp of the last targeted aggregation of the account from the target system.
        [format : yyyy-MM-dd'T'HH:mm:ss or yyyy-MM-dd].
      name: last_target_agg
    - description: Unique name of the identity for which all accounts will be returned.
      name: identity_name
    - description: Unique name of the application for which all accounts will be returned.
      name: application_name
    description: Fetch accounts by search/filter parameters (id, display_name, last_refresh, native_identity, last_target_agg, identity_name & application_name) using IdentityIQ SCIM API's.
    name: identityiq-get-accounts
    outputs:
    - contextPath: IdentityIQ.Account.id
      description: Internal id of the account.
      type: String
    - contextPath: IdentityIQ.Account.identity.value
      description: Internal id of the identity that this account belongs to.
      type: String
    - contextPath: IdentityIQ.Account.identity.displayName
      description: Display name of the identity that this account belongs to.
      type: String
    - contextPath: IdentityIQ.Account.hasEntitlements
      description: True if the account has access entitlements assigned to it, else false.
      type: Boolean
    - contextPath: IdentityIQ.Account.application.value
      description: Internal id of the application that this account is on.
      type: Unknown
    - contextPath: IdentityIQ.Account.application.displayName
      description: Display name of the application that this account is on.
      type: String
    - contextPath: IdentityIQ.Account.nativeIdentity
      description: The name of the account as it exists on the application.
      type: String
    - contextPath: IdentityIQ.Account.lastRefreshed
      description: Timestamp of when this account was last refreshed in IdentityIQ.
      type: Date
  - arguments:
    - description: Internal id of the specific account to be disabled.
      name: id
      required: true
    description: Disable account's active status by id using IdentityIQ SCIM API's.
    name: identityiq-disable-account
    outputs:
    - contextPath: IdentityIQ.AccountDisable.active
      description: Indicates the status of account (should be false after request is successfully completed).
      type: Boolean
  - arguments:
    - description: Internal id of the specific account to be enabled.
      name: id
      required: true
    description: Enable account's active status by id using IdentityIQ SCIM API's.
    name: identityiq-enable-account
    outputs:
    - contextPath: IdentityIQ.AccountDisable.active
      description: Indicates the status of account (should be true after request is successfully completed).
      type: Boolean
  - arguments:
    - description: Internal id of the specific account to be deleted.
      name: id
      required: true
    description: Delete account by id using IdentityIQ SCIM API's.
    execution: true
    name: identityiq-delete-account
  - arguments:
    - description: Internal id of the specific launched workflow being requested.
      name: id
    description: Fetch launched workflow by id or all launched workflows using IdentityIQ SCIM API's.
    name: identitytiq-get-launched-workflows
    outputs:
    - contextPath: IdentityIQ.Workflow.workflowName
      description: Name of the workflow that was launched.
      type: String
    - contextPath: IdentityIQ.Workflow.identityRequestId
      description: Unique id of the identity request that launched this workflow (if exists).
      type: String
    - contextPath: IdentityIQ.Workflow.workflowCaseId
      description: Internal id of the workflowcase for this workflow.
      type: String
    - contextPath: IdentityIQ.Workflow.launched
      description: Timestamp of when this workflow was launched.
      type: Date
    - contextPath: IdentityIQ.Workflow.targetClass
      description: Type of object targeted by the workflow, usually identity.
      type: String
    - contextPath: IdentityIQ.Workflow.targetName
      description: Unique name of the object (username in the case of identity).
      type: String
    - contextPath: IdentityIQ.Workflow.type
      description: The type of workflow.
      type: String
    - contextPath: IdentityIQ.Workflow.id
      description: Internal id of the workflow.
      type: String
    - contextPath: IdentityIQ.Workflow.completionStatus
      description: Status of workflow – 'success', 'failure', 'pending' etc.
      type: String
    - contextPath: IdentityIQ.Workflow.launcher
      description: Name of the identity that launched the workflow.
      type: String
    - contextPath: IdentityIQ.Workflow.terminated
      description: Indicates whether this workflow was terminated due to error or intentionally stopped.
      type: Boolean
    - contextPath: IdentityIQ.Workflow.name
      description: Name of the workflow that was launched.
      type: String
    - contextPath: IdentityIQ.Workflow.attributes
      description: Array of key/value pairs that are the inputs and their values to the workflow.
      type: Unknown
    - contextPath: IdentityIQ.Workflow.output
      description: Array of key/type/value objects that list the output of the workflow.
      type: Unknown
  - arguments:
    - description: Internal id of the specific role being requested.
      name: id
    description: Fetch role by id or all roles using IdentityIQ SCIM API's.
    name: identityiq-get-roles
    outputs:
    - contextPath: IdentityIQ.Role.name
      description: Unique name of the role object in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Role.owner.value
      description: Internal id of the role owner identity.
      type: String
    - contextPath: IdentityIQ.Role.owner.displayName
      description: Displayname of the owner of the role.
      type: String
    - contextPath: IdentityIQ.Role.active
      description: Indicates whether the role is active in IdentityIQ.
      type: Boolean
    - contextPath: IdentityIQ.Role.displayableName
      description: Display name of the role in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Role.permits
      description: Array of roles that this role permits in IdentityIQ.
      type: Unknown
    - contextPath: IdentityIQ.Role.type.name
      description: Template role on which this role is based.
      type: String
    - contextPath: IdentityIQ.Role.type.autoAssignment
      description: Indicates whether this type of role can be auto-assigned to identities.
      type: Boolean
    - contextPath: IdentityIQ.Role.type.displayName
      description: Display name of the template role on which this role was based.
      type: String
    - contextPath: IdentityIQ.Role.type.manualAssignment
      description: Indicates whether this role type can be manually assigned.
      type: String
    - contextPath: IdentityIQ.Role.descriptions.value
      description: Description of the role shown in the UI.
      type: String
  - arguments:
    - description: Internal id of the specific entitlement being requested.
      name: id
    description: Fetch entitlement by id or all entitlements using IdentityIQ SCIM API's.
    name: identityiq-get-entitlements
    outputs:
    - contextPath: IdentityIQ.Entitlement.application.value
      description: Internal id of the application that this entitlement resides on.
      type: String
    - contextPath: IdentityIQ.Entitlement.application.displayName
      description: Display name of the application that this entitlement resides on.
      type: String
    - contextPath: IdentityIQ.Entitlement.attribute
      description: String representing the attribute on the application that this entitlement represents.
      type: String
    - contextPath: IdentityIQ.Entitlement.type
      description: String representing the type of attribute on the application that this entitlement represents.
      type: String
    - contextPath: IdentityIQ.Entitlement.descriptions
      description: Array of description objects that contain a locale, and a value.
      type: Unknown
    - contextPath: IdentityIQ.Entitlement.id
      description: Internal id of the entitlement object in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Entitlement.requestable
      description: Boolean indicates whether this entitlement is directly requestable in the IdentityIQ UI.
      type: Boolean
    - contextPath: IdentityIQ.Entitlement.owner.value
      description: Internal id of the owner of the entitlement in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Entitlement.owner.displayName
      description: Display name of the owner of the entitlement in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Entitlement.aggregated
      description: Indicates whether this entitlement was aggregated from the source system or not.
      type: String
    - contextPath: IdentityIQ.Entitlement.created
      description: Timestamp indicates when the entitlement was created in IdentityIQ.
      type: Date
  - arguments:
    - description: Internal id of the specific alert being requested.
      name: id
    description: Fetch alert by id or all alerts using IdentityIQ SCIM API's.
    name: identityiq-get-alerts
    outputs:
    - contextPath: IdentityIQ.Alert.id
      description: Internal id of the Alert in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Alert.lastProcessed
      description: Timestamp of when this alert was processed by IdentityIQ for match.
      type: Date
    - contextPath: IdentityIQ.Alert.displayName
      description: Display name of the alert in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Alert.meta.created
      description: Timestamp of when this alert was created in IdentityIQ.
      type: Date
    - contextPath: IdentityIQ.Alert.name
      description: Name of the alert in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Alert.attributes
      description: Array of attributes associated with this alert.
      type: Unknown
    - contextPath: IdentityIQ.Alert.actions
      description: Array of actions taken on this alert after processing.
      type: Unknown
    - contextPath: IdentityIQ.Alert.application
      description: List of applications that are related to this alert.
      type: String
  - arguments:
    - description: Display name of the alert.
      name: display_name
      required: true
    - description: |-
        List of JSON objects with the following structure.
        {
            'key': '',
            'value': '',
            'type': ''
        }
      name: attributes
    description: Create an alert using IdentityIQ SCIM API's.
    name: identityiq-create-alert
    outputs:
    - contextPath: IdentityIQ.Alert.id
      description: Internal id of the Alert in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Alert.lastProcessed
      description: Timestamp of when this alert was processed by IdentityIQ for match.
      type: Date
    - contextPath: IdentityIQ.Alert.displayName
      description: Display name of the alert in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Alert.meta.created
      description: Timestamp of when this alert.
      type: Date
    - contextPath: IdentityIQ.Alert.name
      description: Unique name of the alert in IdentityIQ.
      type: String
    - contextPath: IdentityIQ.Alert.attributes
      description: Array of attributes associated with this alert.
      type: Unknown
    - contextPath: IdentityIQ.Alert.actions
      description: Array of actions taken on this alert after processing.
      type: Unknown
    - contextPath: IdentityIQ.Alert.application
      description: List of applications that are related to this alert.
      type: String
  dockerimage: demisto/python3:3.12.14.12277297
  isfetch: true
  script: ''
  subtype: python3
  type: python
  runonce: false
fromversion: 6.0.0
tests:
- SailPointIdentityIQ-Test