SailPointIdentityNow

The SailPoint Identity Security platform can be configured either on-prem/single tenant SaaS, or multi-tenant. This package is intended to be used with the SaaS, multi-tenant solution, IdentityNow.

Data Enrichment & Threat Intelligence · SailPoint IdentityNow

Details

IDSailPointIdentityNow
ProviderSailPoint Technologies
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.8428455
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

SailPoint IdentityNow
This integration was integrated and tested with SailPoint IdentityNow.

Configure SailPointIdentityNow in Cortex

Parameter Description Required
identitynow_url IdentityNow Server URL (e.g. https://org.api.identitynow.com) True
client_id Client Id (for OAuth 2.0) True
client_secret Client Secret (for OAuth 2.0) True
isFetch Fetch incidents False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
incidentType Incident type False
max_fetch Maximum number of incidents per fetch False
first_fetch First fetch time False

Important Note

This integration pack does not fetch incidents from IdentityNow. It rather utilizes “Generic Webhook” to create incidents on event triggers published by IdentityNow. One can achieve this by following the steps below:

  1. Configure Cortex XSOAR Platform - Use the following link to configure Cortex XSOAR platform to initiate receiving of Event Triggers from IdentityNow platform.
  • https://xsoar.pan.dev/docs/reference/integrations/generic-webhook
  • Select “SailPoint IdentityNow Trigger” as the “Incident Type” in the “Generic Webhook” configuration.
  1. Enable & Configure the Event Handler - IdentityNow Event Trigger can forward the events occurring within the platform to any external services/platform that have subscribed to the list of triggers available in IdentityNow. Request the IdentityNow team to enable/provide you with the ‘identitynow-events-pan-xsoar’ event handler designed for Cortex XSOAR. This is a standalone .nodejs microservice that assists with event trigger transform and relaying to Cortex XSOAR.
    Following is a list of environment variables (added to the app.config.js) needed to configure this microservice:
Environment Variable Description
XSOAR_WEBHOOK_URL This is the webhook URL that will be available once you configure the “Generic Webhook” in step 1.
XSOAR_USERNAME Username to connect to the “Generic Webhook”.
XSOAR_PASSWORD Password to connect to the “Generic Webhook”.
  1. Configure IdentityNow Platform - Use the following link to configure IdentityNow platform to subscribe to event triggers.
  • https://community.sailpoint.com/t5/Admin-Help/Event-Triggers-in-SailPoint-s-Cloud-Services/ta-p/178285

Once you have configured all the above steps, whenever an event trigger will occur in IdentityNow, it will notify Cortex XSOAR (as Incidents) using the above setup.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

identitynow-search-identities

Search for identity(identities) using elastic search query used by IdentityNow Search Engine.

Base Command

identitynow-search-identities

Input

Argument Name Description Required
query Elastic search query for retrieving identities. Required
offset Offset into the full result set. Usually specified with limit to paginate through the results. Optional
limit Max number of results to return. Maximum of 250. Optional

Context Output

Path Type Description
SailPointIdentityNow.Identity.id String The IdentityNow internal Id (uuid).
SailPointIdentityNow.Identity.name String Name of the identity.
SailPointIdentityNow.Identity.displayName String The display name of the identity.
SailPointIdentityNow.Identity.firstName String The first name of the identity.
SailPointIdentityNow.Identity.lastName String The last name of the identity.
SailPointIdentityNow.Identity.email String Email address of the Identity.
SailPointIdentityNow.Identity.created Date Timestamp when the identity was created.
SailPointIdentityNow.Identity.modified Date Timestamp when the identity was last modified.
SailPointIdentityNow.Identity.inactive Boolean Indicates whether the identity is active.
SailPointIdentityNow.Identity.protected Boolean Indicates whether this identity is protected.
SailPointIdentityNow.Identity.status String Status of this Identity.
SailPointIdentityNow.Identity.isManager Boolean Indicates whether this identity is a manager.
SailPointIdentityNow.Identity.identityProfile String Identity profile that maps this identity.
SailPointIdentityNow.Identity.source String Source that maps this identity.
SailPointIdentityNow.Identity.attributes String Map of variable number of attributes unique to this identity.
SailPointIdentityNow.Identity.accounts String Array of objects representing the accounts belonging to this identity.
SailPointIdentityNow.Identity.accountCount Number Number of accounts belonging to this identity.
SailPointIdentityNow.Identity.appCount Number Number of applications belonging to this identity.
SailPointIdentityNow.Identity.accessCount Number Number of access objects belonging to this identity.
SailPointIdentityNow.Identity.entitlementCount Number Number of entitlements assigned to this identity.
SailPointIdentityNow.Identity.roleCount Number Number of roles assigned to this identity.
SailPointIdentityNow.Identity.accessProfileCount Number Number of access profiles assigned to this identity.
SailPointIdentityNow.Identity.pod String Pod on which the organization that this identity belongs to resides on.
SailPointIdentityNow.Identity.org String The organization that this identity belongs to.
SailPointIdentityNow.Identity.type String Type of object, will be “identity”.

Command Example

!identitynow-search-identities query=id:2c918084740346d5017408d79229489e

Human Readable Output

Results

Total: 1

Identity(Identities)

id name displayName firstName lastName email created modified inactive protected status isManager identityProfile source attributes accounts accountCount appCount accessCount entitlementCount roleCount accessProfileCount pod org type
2c918084740346d5017408d79229489e testy.testerson@sailpoint.com testy.testerson@sailpoint.com testy.testerson@sailpoint.com testy.testerson@sailpoint.com testy.testerson@sailpoint.com 2020-08-19T22:29:39.498Z 2021-02-04T02:03:11.294Z false false UNREGISTERED false id: 2c9180887372d217017408d3c85d0b20
name: ZIA Users		 id: 2c91808a737cf404017408d28c1e77a2
name: ZIA		 uid: 7a736361-6c65-7200-7363-696d005d7d1a
firstname: testy.testerson@sailpoint.com
cloudAuthoritativeSource: 2c91808a737cf404017408d28c1e77a2
cloudStatus: UNREGISTERED
iplanet-am-user-alias-list:
displayName: testy.testerson@sailpoint.com
internalCloudStatus: UNREGISTERED
identificationNumber: 7a736361-6c65-7200-7363-696d005d7d1a
email: testy.testerson@sailpoint.com
lastname: testy.testerson@sailpoint.com		 {‘id’: ‘2c918084740346d5017408d7922a489f’, ‘name’: ‘testy.testerson@sailpoint.com’, ‘accountId’: ‘7a736361-6c65-7200-7363-696d005d7d1a’, ‘source’: {‘id’: ‘2c91808a737cf404017408d28c1e77a2’, ‘name’: ‘ZIA’, ‘type’: ‘SCIM 2.0’}, ‘disabled’: False, ‘locked’: False, ‘privileged’: False, ‘manuallyCorrelated’: False, ‘entitlementAttributes’: {}, ‘created’: ‘2020-08-19T22:29:39.498Z’},
{‘id’: ‘2c918084740346d601740c98765a306e’, ‘name’: ‘testy.testerson@sailpoint.com’, ‘accountId’: ‘testy.testerson@sailpoint.com’, ‘source’: {‘id’: ‘2c91808563f9f8b40163fa9734d3029f’, ‘name’: ‘IdentityNow’, ‘type’: ‘IdentityNowConnector’}, ‘disabled’: False, ‘locked’: False, ‘privileged’: False, ‘manuallyCorrelated’: False, ‘entitlementAttributes’: {}, ‘created’: ‘2020-08-20T15:59:12.475Z’}		 2 0 0 0 0 0 stg-uswest sailpoint-idn identity

identitynow-get-accounts

Get accounts by search/filter parameters (id, name, native_identity).

Base Command

identitynow-get-accounts

Input

Argument Name Description Required
id Account Id of the user/identity. Optional
name Name of the user/identity on the account. Optional
native_identity Native identity for the user account. Optional
offset Offset into the full result set. Usually specified with limit to paginate through the results. Optional
limit Max number of results to return. Maximum of 250. Optional

Context Output

Path Type Description
SailPointIdentityNow.Account.id String The IdentityNow internal id (uuid).
SailPointIdentityNow.Account.name String Name of the identity on this account.
SailPointIdentityNow.Account.identityId String The IdentityNow internal identity id.
SailPointIdentityNow.Account.nativeIdentity String The IdentityNow internal native identity id.
SailPointIdentityNow.Account.sourceId String Source id that maps this account.
SailPointIdentityNow.Account.created Date Timestamp when the account was created.
SailPointIdentityNow.Account.modified Date Timestamp when the account was last modified.
SailPointIdentityNow.Account.attributes String Map of variable number of attributes unique to this account.
SailPointIdentityNow.Account.authoritative Boolean Indicates whether the account is the true source for this identity.
SailPointIdentityNow.Account.disabled Boolean Indicates whether the account is disabled.
SailPointIdentityNow.Account.locked Boolean Indicates whether the account is locked.
SailPointIdentityNow.Account.systemAccount Boolean Indicates whether the account is a system account.
SailPointIdentityNow.Account.uncorrelated Boolean Indicates whether the account is uncorrelated.
SailPointIdentityNow.Account.manuallyCorrelated Boolean Indicates whether the account was manually correlated.
SailPointIdentityNow.Account.hasEntitlements Boolean Indicates whether the account has entitlement.

Command Example

!identitynow-get-accounts id=2c918084740346d30174088afa6d625e

Human Readable Output

Results

Account(s)

id name identityId nativeIdentity sourceId created modified attributes authoritative disabled locked systemAccount uncorrelated manuallyCorrelated hasEntitlements
2c918084740346d30174088afa6d625e Testy.Testerson   41263 2c918084737cf3fe01740875ebac75cd 2020-08-19T21:05:59.917Z 2020-08-19T21:06:01.269Z externalId: null
IIQDisabled: true
id: 41263
userName: Testy.Testerson
idNowDescription: f74806c7011b760457c914ef5ea254b8752496a441a92475b910ded9eb5ec487		 false true false false true false false

identitynow-get-accountactivities

Get account activities by search/filter parameters (requested_for, requested_by, regarding_identity, type).

Base Command

identitynow-get-accountactivities

Input

Argument Name Description Required
id Account activity Id. Optional
requested_for The identity that the activity was requested for (me indicates current user). Optional
requested_by The identity that requested the activity (me indicates current user). Optional
regarding_identity The specified identity will be either requester or target of account activity (me indicates current user). Optional
type Type of account activity. Optional
offset Offset into the full result set. Usually specified with limit to paginate through the results. Optional
limit Max number of results to return. Maximum of 250. Optional

Context Output

Path Type Description
SailPointIdentityNow.AccountActivity.id String The IdentityNow internal id (uuid).
SailPointIdentityNow.AccountActivity.name String Name of the account activity.
SailPointIdentityNow.AccountActivity.created Date Timestamp when the account activity was created.
SailPointIdentityNow.AccountActivity.modified Date Timestamp when the account activity was last modified.
SailPointIdentityNow.AccountActivity.completed Date Timestamp when the account activity was completed.
SailPointIdentityNow.AccountActivity.completionStatus String Completion status of the activity.
SailPointIdentityNow.AccountActivity.type String Type of account activity.
SailPointIdentityNow.AccountActivity.requesterIdentitySummary String Information of the requester identity.
SailPointIdentityNow.AccountActivity.targetIdentitySummary String Information of the target identity.
SailPointIdentityNow.AccountActivity.items String List of items that were requested as part of the account activity.
SailPointIdentityNow.AccountActivity.executionStatus String Execution status of the account activity.
SailPointIdentityNow.AccountActivity.cancelable Boolean Indicates whether the account activity is cancelable.
SailPointIdentityNow.AccountActivity.cancelComment String Comments added while canceling the account activity.

Command Example

!identitynow-get-accountactivities id=c8f2907b336043be8570676b270965a9

Human Readable Output

Results

Account Activity(Account Activities)

id name created modified completed completionStatus type requesterIdentitySummary targetIdentitySummary items executionStatus cancelable cancelComment
c8f2907b336043be8570676b270965a9 c8f2907b336043be8570676b270965a9 2020-02-20T15:28:47.051Z 2020-02-20T15:29:10.735Z 2020-02-20T15:29:10.735Z INCOMPLETE appRequest id: 2c91808363f06ad80163fb690fae55b8
name: adam.kennedy		 id: 2c91808a6fca28a6016fd7f5ec3f5228
name: jack.brown		 {} VERIFYING false  

identitynow-search-accessprofiles

Search for access profile(s) using elastic search query used by IdentityNow Search Engine.

Base Command

identitynow-search-accessprofiles

Input

Argument Name Description Required
query Elastic search query for retrieving identities. Required
offset Offset into the full result set. Usually specified with limit to paginate through the results. Optional
limit Max number of results to return. Maximum of 250. Optional

Context Output

Path Type Description
SailPointIdentityNow.AccessProfile.id String The IdentityNow internal id of the access profile object.
SailPointIdentityNow.AccessProfile.name String Name of the access profile object.
SailPointIdentityNow.AccessProfile.description String User friendly description of the access profile.
SailPointIdentityNow.AccessProfile.source String Source of the access profile.
SailPointIdentityNow.AccessProfile.entitlements String Entitlements included in the access profile.
SailPointIdentityNow.AccessProfile.entitlementCount Number Number of entitlements included in the access profile.
SailPointIdentityNow.AccessProfile.created Date Date when the access profile was created.
SailPointIdentityNow.AccessProfile.modified Date Date when the access profile was last modified.
SailPointIdentityNow.AccessProfile.synced Date Date when the access profile was last synced.
SailPointIdentityNow.AccessProfile.enabled Boolean Indicates whether the access profile is active (true/false).
SailPointIdentityNow.AccessProfile.requestable Boolean Indicates whether the access profile is requestable in IdentityNow.
SailPointIdentityNow.AccessProfile.requestCommentsRequired Boolean Indicates whether any request for this profile must contain comments.
SailPointIdentityNow.AccessProfile.owner String Owner of the access profile.
SailPointIdentityNow.AccessProfile.pod String Pod that the organization containing the access profile belongs to.
SailPointIdentityNow.AccessProfile.org String Name of the org on which the access profile exists.
SailPointIdentityNow.AccessProfile.type String Type of access profile, will be “accessprofile”.

Command Example

!identitynow-search-accessprofiles query=id:2c91808874feffbc01750a4d06560370

Human Readable Output

Results

Total: 1

Access Profile(s)

id name description source entitlements entitlementCount created modified synced enabled requestable requestCommentsRequired owner pod org type
2c91808874feffbc01750a4d06560370 Basic Users Basic Users id: 2c9180876ff2de9601700b99e5fb51c6
name: Direct Access Profile		 {‘hasPermissions’: False, ‘description’: None, ‘attribute’: ‘Roles’, ‘value’: ‘Basic Users’, ‘schema’: ‘group’, ‘privileged’: False, ‘id’: ‘2c91808a6fede9c401700ba9c4d43ef9’, ‘name’: ‘Basic Users’} 1 2020-10-08T22:20:21Z 2020-11-17T15:12:41Z 2021-03-01T06:30:18.772Z true true false email: adam.kennedy@sailpoint.com
type: IDENTITY
id: 2c91808363f06ad80163fb690fae55b8
name: adam.kennedy		 stg-uswest sailpoint-idn accessprofile

identitynow-search-roles

Search for role(s) using elastic search query used by IdentityNow Search Engine.

Base Command

identitynow-search-roles

Input

Argument Name Description Required
query Elastic search query for retrieving roles. Required
offset Offset into the full result set. Usually specified with limit to paginate through the results. Optional
limit Max number of results to return. Maximum of 250. Optional

Context Output

Path Type Description
SailPointIdentityNow.Role.id String The IdentityNow internal id of the role object.
SailPointIdentityNow.Role.name String Name of the role.
SailPointIdentityNow.Role.description String Description of this role.
SailPointIdentityNow.Role.accessProfiles Unknown Array of objects representing the access profiles that belong to this role.
SailPointIdentityNow.Role.accessProfileCount Number Number indicated how many access profiles are attached to this role.
SailPointIdentityNow.Role.created Date Timestamp when this role was created.
SailPointIdentityNow.Role.modified Date Timestamp when this role was last modified.
SailPointIdentityNow.Role.synced Date Timestamp when this role was last synced.
SailPointIdentityNow.Role.enabled Boolean Indicates whether this role is enabled.
SailPointIdentityNow.Role.requestable Boolean Indicates whether this role is requestable.
SailPointIdentityNow.Role.requestCommentsRequired Boolean Indicates whether comments are required when requesting this role.
SailPointIdentityNow.Role.owner String Owner of the role.
SailPointIdentityNow.Role.pod String Pod on which the organization responsible for this role belongs.
SailPointIdentityNow.Role.org String Organization on which this role exists.
SailPointIdentityNow.Role.type String Type of object, will be “role”.

Command Example

!identitynow-search-roles query=id:2c9180846ff9c50201700beb2e9000da

Human Readable Output

Results

Total: 1

Role(s)

id name description accessProfiles accessProfileCount created modified synced enabled requestable requestCommentsRequired owner pod org type
2c9180846ff9c50201700beb2e9000da Basic Basic Users {‘id’: ‘2c9180846ff9c50201700becb01e00db’, ‘name’: ‘Basic’} 1 2020-02-03T16:38:47Z 2020-02-03T16:40:42Z 2021-03-01T05:30:09.434Z true true false email: adam.kennedy@sailpoint.com
type: IDENTITY
id: 2c91808363f06ad80163fb690fae55b8
name: adam.kennedy		 stg-uswest sailpoint-idn role

identitynow-search-entitlements

Search for entitlement(s) using elastic search query used by IdentityNow Search Engine.

Base Command

identitynow-search-entitlements

Input

Argument Name Description Required
query Elastic search query for retrieving entitlements. Required
offset Offset into the full result set. Usually specified with limit to paginate through the results. Optional
limit Max number of results to return. Maximum of 250. Optional

Context Output

Path Type Description
SailPointIdentityNow.Entitlement.id String The IdentityNow internal id of the entitlement object.
SailPointIdentityNow.Entitlement.name String Name of the entitlement object.
SailPointIdentityNow.Entitlement.displayName String Displayname of the entitlement object.
SailPointIdentityNow.Entitlement.description String Description of the entitlement.
SailPointIdentityNow.Entitlement.modified Date Timestamp when the entitlement was last modified.
SailPointIdentityNow.Entitlement.synced Date Timestamp when the entitlement was last synced.
SailPointIdentityNow.Entitlement.source String Source from which this entitlement was aggregated.
SailPointIdentityNow.Entitlement.privileged Boolean Indicates this is a privileged entitlement.
SailPointIdentityNow.Entitlement.identityCount Number Indicates how many identities have this entitlement.
SailPointIdentityNow.Entitlement.attribute String Name of the attribute type on the source.
SailPointIdentityNow.Entitlement.value String Value of the entitlement (its native identifier).
SailPointIdentityNow.Entitlement.schema String The source schema that this entitlement utilizes.
SailPointIdentityNow.Entitlement.pod String Pod on which the organization this entitlement belongs to is located.
SailPointIdentityNow.Entitlement.org String Organization on which the source of this entitlement resides.
SailPointIdentityNow.Entitlement.type String Type of object, will be “entitlement”.

Command Example

!identitynow-search-entitlements query=id:2c9180846ff7e56b01700bb399f60eaa

Human Readable Output

Results

Total: 1

Entitlement(s)

id name displayName description modified synced source privileged identityCount attribute value schema pod org type
2c9180846ff7e56b01700bb399f60eaa BASIC_DIRECT BASIC_DIRECT   2020-10-21T19:58:39Z 2021-03-01T04:30:40.632Z id: 2c9180876ff2de9601700b99e5fb51c6
name: Basic Direct		 false   Roles BASIC_DIRECT group stg-uswest sailpoint-idn entitlement

identitynow-search-events

Search for event(s) using elastic search query used by IdentityNow Search Engine.

Base Command

identitynow-search-events

Input

Argument Name Description Required
query Elastic search query for retrieving events. Required
offset Offset into the full result set. Usually specified with limit to paginate through the results. Optional
limit Max number of results to return. Maximum of 250. Optional

Context Output

Path Type Description
SailPointIdentityNow.Event.id String The IdentityNow internal id of the event object.
SailPointIdentityNow.Event.name String Name of the event.
SailPointIdentityNow.Event.stack String Component that triggered the event.
SailPointIdentityNow.Event.created Date Timestamp when the event was created.
SailPointIdentityNow.Event.synced String Timestamp when the event was last synced.
SailPointIdentityNow.Event.objects Unknown Array of object types that were the target of this event.
SailPointIdentityNow.Event.ipAddress String IP address that triggered this event.
SailPointIdentityNow.Event.technicalName String System name for the event.
SailPointIdentityNow.Event.target String Target of this event action.
SailPointIdentityNow.Event.actor String Entity that initiated the action that caused this event.
SailPointIdentityNow.Event.action String Action type of the event.
SailPointIdentityNow.Event.attributes String Attributes of other interesting information about this event, contextual to the type.
SailPointIdentityNow.Event.operation String Operation performed that triggered event.
SailPointIdentityNow.Event.status String Status of the event.
SailPointIdentityNow.Event.pod String Pod on which the organization that the event exists.
SailPointIdentityNow.Event.org String Organization that initiated the event.
SailPointIdentityNow.Event.type String Type of event.

Command Example

!identitynow-search-events query=id:2bd61299-d986-4c27-bd37-408b9c9ba118

Human Readable Output

Results

Total: 1

Event(s)

id name stack created synced objects ipAddress technicalName target actor action attributes operation status pod org type
2bd61299-d986-4c27-bd37-408b9c9ba118 Delete Task Result Passed sweep 2020-02-24T22:07:03.793Z 2020-02-24T22:07:03.831Z TASK,
RESULT		   TASK_RESULT_DELETE_PASSED   name: unknown taskResultsPruned hostName: 24
sourceName: null		 DELETE PASSED stg-uswest sailpoint-idn SYSTEM_CONFIG

identitynow-request-grant

Grant access request for a single object(access profile or role) for a single user.

Base Command

identitynow-request-grant

Input

Argument Name Description Required
requested_for Identity Id for whom the access request is being made. Required
requested_item Id of the object(access profile or role). Required
requested_item_type Type of object(ACCESS_PROFILE or ROLE). Required
comment Comments to attach to the item request. Optional

Context Output

There is no context output for this command.

Command Example

!identitynow-request-grant requested_for=2c9180886ccef167016cdb658fb6547a requested_item=2c918086775e1f5d01776530eb67037b requested_item_type=ACCESS_PROFILE comment=PAN_XSOAR_TEST

Human Readable Output

Access request was successful!

identitynow-request-revoke

Revoke access request for a single object(access profile or role) for a single user.

Base Command

identitynow-request-revoke

Input

Argument Name Description Required
requested_for Identity Id for whom the access request is being made. Required
requested_item Id of the object(access profile or role). Required
requested_item_type Type of object(ACCESS_PROFILE or ROLE). Required
comment Comments to attach to the item request. Optional

Context Output

There is no context output for this command.

Command Example

!identitynow-request-revoke requested_for=2c9180886ccef167016cdb658fb6547a requested_item=2c918086775e1f5d01776530eb67037b requested_item_type=ACCESS_PROFILE comment=PAN_XSOAR_TEST

Human Readable Output

Access request was successful!

Configuration parameters

  • identitynow_url — IdentityNow Server URL (e.g. https://org.api.identitynow.com) (required)
  • client_id — Client Id (for OAuth 2.0) (required)
  • client_secret — Client Secret (for OAuth 2.0) (required)
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • request_timeout — Request timeout (in seconds)
  • incidentType — Incident type

Commands (9)

  • identitynow-get-accountactivities

    Get account activities by search/filter parameters (requested_for, requested_by, regarding_identity, type).

  • identitynow-get-accounts

    Get accounts by search/filter parameters (id, name, native_identity).

  • identitynow-request-grant

    Grant access request for a single object(access profile or role) for a single user.

  • identitynow-request-revoke

    Revoke access request for a single object(access profile or role) for a single user.

  • identitynow-search-accessprofiles

    Search for access profile(s) using elastic search query used by IdentityNow Search Engine.

  • identitynow-search-entitlements

    Search for entitlement(s) using elastic search query used by IdentityNow Search Engine.

  • identitynow-search-events

    Search for event(s) using elastic search query used by IdentityNow Search Engine.

  • identitynow-search-identities

    Search for identity(identities) using elastic search query used by IdentityNow Search Engine.

  • identitynow-search-roles

    Search for role(s) using elastic search query used by IdentityNow Search Engine.

Source

SailPointIdentityNow.py SailPointIdentityNow_test.py SailPointIdentityNow.yml SailPointIdentityNow_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: SailPoint Technologies
commonfields:
  id: SailPointIdentityNow
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: The FQDN/IP of the IdentityNow server to connect
  display: IdentityNow Server URL (e.g. https://org.api.identitynow.com)
  name: identitynow_url
  required: true
  type: 12
  section: Connect
- additionalinfo: Client Id for OAuth 2.0
  display: Client Id (for OAuth 2.0)
  name: client_id
  required: true
  type: 0
  section: Connect
- additionalinfo: Client Secret for OAuth 2.0
  display: Client Secret (for OAuth 2.0)
  name: client_secret
  required: true
  type: 4
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: '60'
  display: Request timeout (in seconds)
  name: request_timeout
  required: false
  type: 0
  section: Connect
  advanced: true
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
description: The SailPoint Identity Security platform can be configured either on-prem/single tenant SaaS, or multi-tenant. This package is intended to be used with the SaaS, multi-tenant solution, IdentityNow.
display: SailPoint IdentityNow
name: SailPointIdentityNow
script:
  commands:
  - arguments:
    - description: Elastic search query for retrieving identities.
      name: query
      required: true
    - description: Offset into the full result set. Usually specified with limit to paginate through the results.
      name: offset
    - description: Max number of results to return. Maximum of 250.
      name: limit
    description: Search for identity(identities) using elastic search query used by IdentityNow Search Engine.
    name: identitynow-search-identities
    outputs:
    - contextPath: SailPointIdentityNow.Identity.id
      description: The IdentityNow internal Id (uuid).
      type: String
    - contextPath: SailPointIdentityNow.Identity.name
      description: Name of the identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.displayName
      description: The display name of the identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.firstName
      description: The first name of the identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.lastName
      description: The last name of the identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.email
      description: Email address of the Identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.created
      description: 'Timestamp when the identity was created. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Identity.modified
      description: 'Timestamp when the identity was last modified. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Identity.inactive
      description: Indicates whether the identity is active.
      type: Boolean
    - contextPath: SailPointIdentityNow.Identity.protected
      description: Indicates whether this identity is protected.
      type: Boolean
    - contextPath: SailPointIdentityNow.Identity.status
      description: Status of this Identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.isManager
      description: Indicates whether this identity is a manager.
      type: Boolean
    - contextPath: SailPointIdentityNow.Identity.identityProfile
      description: Identity profile that maps this identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.source
      description: Source that maps this identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.attributes
      description: Map of variable number of attributes unique to this identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.accounts
      description: Array of objects representing the accounts belonging to this identity.
      type: String
    - contextPath: SailPointIdentityNow.Identity.accountCount
      description: Number of accounts belonging to this identity.
      type: Number
    - contextPath: SailPointIdentityNow.Identity.appCount
      description: Number of applications belonging to this identity.
      type: Number
    - contextPath: SailPointIdentityNow.Identity.accessCount
      description: Number of access objects belonging to this identity.
      type: Number
    - contextPath: SailPointIdentityNow.Identity.entitlementCount
      description: Number of entitlements assigned to this identity.
      type: Number
    - contextPath: SailPointIdentityNow.Identity.roleCount
      description: Number of roles assigned to this identity.
      type: Number
    - contextPath: SailPointIdentityNow.Identity.accessProfileCount
      description: Number of access profiles assigned to this identity.
      type: Number
    - contextPath: SailPointIdentityNow.Identity.pod
      description: Pod on which the organization that this identity belongs to resides on.
      type: String
    - contextPath: SailPointIdentityNow.Identity.org
      description: The organization that this identity belongs to.
      type: String
    - contextPath: SailPointIdentityNow.Identity.type
      description: Type of object, will be "identity".
      type: String
  - arguments:
    - description: Account Id of the user/identity(uuid).
      name: id
    - description: Name of the user/identity on the account.
      name: name
    - description: Native identity for the user account.
      name: native_identity
    - description: Offset into the full result set. Usually specified with limit to paginate through the results.
      name: offset
    - description: Max number of results to return. Maximum of 250.
      name: limit
    description: Get accounts by search/filter parameters (id, name, native_identity).
    name: identitynow-get-accounts
    outputs:
    - contextPath: SailPointIdentityNow.Account.id
      description: The IdentityNow internal id (uuid).
      type: String
    - contextPath: SailPointIdentityNow.Account.name
      description: Name of the identity on this account.
      type: String
    - contextPath: SailPointIdentityNow.Account.identityId
      description: The IdentityNow internal identity id.
      type: String
    - contextPath: SailPointIdentityNow.Account.nativeIdentity
      description: The IdentityNow internal native identity id.
      type: String
    - contextPath: SailPointIdentityNow.Account.sourceId
      description: Source id that maps this account.
      type: String
    - contextPath: SailPointIdentityNow.Account.created
      description: 'Timestamp when the account was created. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Account.modified
      description: 'Timestamp when the account was last modified. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Account.attributes
      description: Map of variable number of attributes unique to this account.
      type: String
    - contextPath: SailPointIdentityNow.Account.authoritative
      description: Indicates whether the account is the true source for this identity.
      type: Boolean
    - contextPath: SailPointIdentityNow.Account.disabled
      description: Indicates whether the account is disabled.
      type: Boolean
    - contextPath: SailPointIdentityNow.Account.locked
      description: Indicates whether the account is locked.
      type: Boolean
    - contextPath: SailPointIdentityNow.Account.systemAccount
      description: Indicates whether the account is a system account.
      type: Boolean
    - contextPath: SailPointIdentityNow.Account.uncorrelated
      description: Indicates whether the account is uncorrelated.
      type: Boolean
    - contextPath: SailPointIdentityNow.Account.manuallyCorrelated
      description: Indicates whether the account was manually correlated.
      type: Boolean
    - contextPath: SailPointIdentityNow.Account.hasEntitlements
      description: Indicates whether the account has entitlement.
      type: Boolean
  - arguments:
    - description: Account activity Id (uuid).
      name: id
    - description: The identity (uuid) that the activity was requested for (me indicates current user).
      name: requested_for
    - description: The identity (uuid) that requested the activity (me indicates current user).
      name: requested_by
    - description: The specified identity (uuid) will be either requester or target of account activity (me indicates current user).
      name: regarding_identity
    - description: Type of account activity.
      name: type
    - description: Offset into the full result set. Usually specified with limit to paginate through the results.
      name: offset
    - description: Max number of results to return. Maximum of 250.
      name: limit
    description: Get account activities by search/filter parameters (requested_for, requested_by, regarding_identity, type).
    name: identitynow-get-accountactivities
    outputs:
    - contextPath: SailPointIdentityNow.AccountActivity.id
      description: The IdentityNow internal id (uuid).
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.name
      description: Name of the account activity.
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.created
      description: 'Timestamp when the account activity was created. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.AccountActivity.modified
      description: 'Timestamp when the account activity was last modified. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.AccountActivity.completed
      description: 'Timestamp when the account activity was completed. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.AccountActivity.completionStatus
      description: Completion status of the activity.
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.type
      description: Type of account activity.
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.requesterIdentitySummary
      description: Information of the requester identity.
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.targetIdentitySummary
      description: Information of the target identity.
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.items
      description: List of items that were requested as part of the account activity.
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.executionStatus
      description: Execution status of the account activity.
      type: String
    - contextPath: SailPointIdentityNow.AccountActivity.cancelable
      description: Indicates whether the account activity is cancelable.
      type: Boolean
    - contextPath: SailPointIdentityNow.AccountActivity.cancelComment
      description: Comments added while canceling the account activity.
      type: String
  - arguments:
    - description: Elastic search query for retrieving identities.
      name: query
      required: true
    - description: Offset into the full result set. Usually specified with limit to paginate through the results.
      name: offset
    - description: Max number of results to return. Maximum of 250.
      name: limit
    description: Search for access profile(s) using elastic search query used by IdentityNow Search Engine.
    name: identitynow-search-accessprofiles
    outputs:
    - contextPath: SailPointIdentityNow.AccessProfile.id
      description: The IdentityNow internal id of the access profile object.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.name
      description: Name of the access profile object.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.description
      description: User friendly description of the access profile.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.source
      description: Source of the access profile.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.entitlements
      description: Entitlements included in the access profile.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.entitlementCount
      description: Number of entitlements included in the access profile.
      type: Number
    - contextPath: SailPointIdentityNow.AccessProfile.created
      description: 'Date when the access profile was created. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.AccessProfile.modified
      description: 'Date when the access profile was last modified. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.AccessProfile.synced
      description: 'Date when the access profile was last synced. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.AccessProfile.enabled
      description: Indicates whether the access profile is active (true/false).
      type: Boolean
    - contextPath: SailPointIdentityNow.AccessProfile.requestable
      description: Indicates whether the access profile is requestable in IdentityNow.
      type: Boolean
    - contextPath: SailPointIdentityNow.AccessProfile.requestCommentsRequired
      description: Indicates whether any request for this profile must contain comments.
      type: Boolean
    - contextPath: SailPointIdentityNow.AccessProfile.owner
      description: Owner of the access profile.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.pod
      description: Pod that the organization containing the access profile belongs to.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.org
      description: Name of the org on which the access profile exists.
      type: String
    - contextPath: SailPointIdentityNow.AccessProfile.type
      description: Type of access profile, will be "accessprofile".
      type: String
  - arguments:
    - description: Elastic search query for retrieving roles.
      name: query
      required: true
    - description: Offset into the full result set. Usually specified with limit to paginate through the results.
      name: offset
    - description: Max number of results to return. Maximum of 250.
      name: limit
    description: Search for role(s) using elastic search query used by IdentityNow Search Engine.
    name: identitynow-search-roles
    outputs:
    - contextPath: SailPointIdentityNow.Role.id
      description: The IdentityNow internal id of the role object.
      type: String
    - contextPath: SailPointIdentityNow.Role.name
      description: Name of the role.
      type: String
    - contextPath: SailPointIdentityNow.Role.description
      description: Description of this role.
      type: String
    - contextPath: SailPointIdentityNow.Role.accessProfiles
      description: Array of objects representing the access profiles that belong to this role.
      type: Unknown
    - contextPath: SailPointIdentityNow.Role.accessProfileCount
      description: Number indicated how many access profiles are attached to this role.
      type: Number
    - contextPath: SailPointIdentityNow.Role.created
      description: 'Timestamp when this role was created. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Role.modified
      description: 'Timestamp when this role was last modified. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Role.synced
      description: 'Timestamp when this role was last synced. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Role.enabled
      description: Indicates whether this role is enabled.
      type: Boolean
    - contextPath: SailPointIdentityNow.Role.requestable
      description: Indicates whether this role is requestable.
      type: Boolean
    - contextPath: SailPointIdentityNow.Role.requestCommentsRequired
      description: Indicates whether comments are required when requesting this role.
      type: Boolean
    - contextPath: SailPointIdentityNow.Role.owner
      description: Owner of the role.
      type: String
    - contextPath: SailPointIdentityNow.Role.pod
      description: Pod on which the organization responsible for this role belongs.
      type: String
    - contextPath: SailPointIdentityNow.Role.org
      description: Organization on which this role exists.
      type: String
    - contextPath: SailPointIdentityNow.Role.type
      description: Type of object, will be "role".
      type: String
  - arguments:
    - description: Elastic search query for retrieving entitlements.
      name: query
      required: true
    - description: Offset into the full result set. Usually specified with limit to paginate through the results.
      name: offset
    - description: Max number of results to return. Maximum of 250.
      name: limit
    description: Search for entitlement(s) using elastic search query used by IdentityNow Search Engine.
    name: identitynow-search-entitlements
    outputs:
    - contextPath: SailPointIdentityNow.Entitlement.id
      description: The IdentityNow internal id of the entitlement object.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.name
      description: Name of the entitlement object.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.displayName
      description: Displayname of the entitlement object.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.description
      description: Description of the entitlement.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.modified
      description: 'Timestamp when the entitlement was last modified. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Entitlement.synced
      description: 'Timestamp when the entitlement was last synced. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Entitlement.source
      description: Source from which this entitlement was aggregated.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.privileged
      description: Indicates this is a privileged entitlement.
      type: Boolean
    - contextPath: SailPointIdentityNow.Entitlement.identityCount
      description: Indicates how many identities have this entitlement.
      type: Number
    - contextPath: SailPointIdentityNow.Entitlement.attribute
      description: Name of the attribute type on the source.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.value
      description: Value of the entitlement (its native identifier).
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.schema
      description: The source schema that this entitlement utilizes.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.pod
      description: Pod on which the organization this entitlement belongs to is located.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.org
      description: Organization on which the source of this entitlement resides.
      type: String
    - contextPath: SailPointIdentityNow.Entitlement.type
      description: Type of object, will be "entitlement".
      type: String
  - arguments:
    - description: Elastic search query for retrieving events.
      name: query
      required: true
    - description: Offset into the full result set. Usually specified with limit to paginate through the results.
      name: offset
    - description: Max number of results to return. Maximum of 250.
      name: limit
    description: Search for event(s) using elastic search query used by IdentityNow Search Engine.
    name: identitynow-search-events
    outputs:
    - contextPath: SailPointIdentityNow.Event.id
      description: The IdentityNow internal id of the event object.
      type: String
    - contextPath: SailPointIdentityNow.Event.name
      description: Name of the event.
      type: String
    - contextPath: SailPointIdentityNow.Event.stack
      description: Component that triggered the event.
      type: String
    - contextPath: SailPointIdentityNow.Event.created
      description: 'Timestamp when the event was created. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: Date
    - contextPath: SailPointIdentityNow.Event.synced
      description: 'Timestamp when the event was last synced. ISO8601 format: 2020-01-01T00:11:22Z.'
      type: String
    - contextPath: SailPointIdentityNow.Event.objects
      description: Array of object types that were the target of this event.
      type: Unknown
    - contextPath: SailPointIdentityNow.Event.ipAddress
      description: IP address that triggered this event.
      type: String
    - contextPath: SailPointIdentityNow.Event.technicalName
      description: System name for the event.
      type: String
    - contextPath: SailPointIdentityNow.Event.target
      description: Target of this event action.
      type: String
    - contextPath: SailPointIdentityNow.Event.actor
      description: Entity that initiated the action that caused this event.
      type: String
    - contextPath: SailPointIdentityNow.Event.action
      description: Action type of the event.
      type: String
    - contextPath: SailPointIdentityNow.Event.attributes
      description: Attributes of other interesting information about this event, contextual to the type.
      type: String
    - contextPath: SailPointIdentityNow.Event.operation
      description: Operation performed that triggered event.
      type: String
    - contextPath: SailPointIdentityNow.Event.status
      description: Status of the event.
      type: String
    - contextPath: SailPointIdentityNow.Event.pod
      description: Pod on which the organization that the event exists.
      type: String
    - contextPath: SailPointIdentityNow.Event.org
      description: Organization that initiated the event.
      type: String
    - contextPath: SailPointIdentityNow.Event.type
      description: Type of event.
      type: String
  - arguments:
    - description: Identity Id (uuid) for whom the access request is being made.
      name: requested_for
      required: true
    - description: Id (uuid) of the object (access profile or role).
      name: requested_item
      required: true
    - auto: PREDEFINED
      description: Type of object (ACCESS_PROFILE or ROLE).
      name: requested_item_type
      predefined:
      - ACCESS_PROFILE
      - ROLE
      required: true
    - description: Comments to attach to the item request.
      name: comment
    description: Grant access request for a single object(access profile or role) for a single user.
    name: identitynow-request-grant
  - arguments:
    - description: Identity Id (uuid) for whom the access request is being made.
      name: requested_for
      required: true
    - description: Id (uuid) of the object(access profile or role).
      name: requested_item
      required: true
    - auto: PREDEFINED
      description: Type of object (ACCESS_PROFILE or ROLE).
      name: requested_item_type
      predefined:
      - ACCESS_PROFILE
      - ROLE
      required: true
    - description: Comments to attach to the item request.
      name: comment
    description: Revoke access request for a single object(access profile or role) for a single user.
    name: identitynow-request-revoke
  dockerimage: demisto/python3:3.12.13.8428455
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- SailPointIdentityNow-Test
defaultmapperin: SailPoint IdentityNow Trigger Mapper
fromversion: 6.0.0