SaviyntEICEventCollector

Details

ID	`SaviyntEICEventCollector`
Provider	Saviynt
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Collector for Saviynt Enterprise Identity Cloud (EIC) audit logs using Analytics Runtime Control V2.
This integration was tested with Saviynt EIC API Reference for Amsterdam GA Release (API v5).

Configure Saviynt EIC Event Collector in Cortex

Parameter	Description	Required
Server URL	The Saviynt EIC server URL (e.g., `https://your-tenant.saviyntcloud.com`).	True
Username	The username for authenticating with the Saviynt EIC API.	True
Password	The password for authenticating with the Saviynt EIC API.	True
Analytics Name	The name of the Analytics Runtime Control to fetch events from. This value must match an existing Analytics Record configured in Saviynt. Default is `SIEMAuditLogs`.	False
Maximum number of events per fetch	The maximum number of events to fetch per interval. Default is 30000.	False
Trust any certificate (not secure)	When selected, certificates are not checked. Not recommended for production environments.	False
Events Fetch Interval	The interval in minutes between event fetches. Default is 1 minute.	False
Use system proxy settings	When selected, uses the system proxy settings to connect to the Saviynt EIC API.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

saviynt-eic-get-events

Gets events from Saviynt EIC.

Base Command

saviynt-eic-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command creates events, otherwise, it only displays them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of results to return (max 10000).	Required
time_frame	Time frame in minutes back from now to query.	Optional
offset	Offset for paging.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — Username (required)
analytics_name — Analytics Name
max_fetch — Maximum number of events per fetch
insecure — Trust any certificate (not secure)
eventFetchInterval — Events Fetch Interval
proxy — Use system proxy settings

Commands (1)

saviynt-eic-get-events
Gets events from Saviynt EIC. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.

Source

SaviyntEICEventCollector.py SaviyntEICEventCollector_test.py SaviyntEICEventCollector.yml SaviyntEICEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: Saviynt
sectionorder:
- Connect
- Collect
commonfields:
  id: SaviyntEICEventCollector
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Analytics Name
  name: analytics_name
  required: false
  type: 0
  section: Collect
  defaultvalue: SIEMAuditLogs
  additionalinfo: The name of the Analytics Runtime Control to fetch events from. This value must match an existing Analytics Record configured in Saviynt. Multiple values are not supported.
- defaultvalue: '30000'
  section: Collect
  display: Maximum number of events per fetch
  name: max_fetch
  required: false
  type: 0
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- name: eventFetchInterval
  section: Collect
  display: Events Fetch Interval
  advanced: true
  defaultvalue: "1"
  type: 19
  required: false
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Collector for Saviynt Enterprise Identity Cloud (EIC) audit logs using Analytics Runtime Control V2.
display: Saviynt Enterprise Identity Cloud
name: SaviyntEICEventCollector
script:
  commands:
  - arguments:
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command creates events, otherwise, it only displays them.
      isArray: false
      predefined:
      - 'true'
      - 'false'
      required: false
    - name: limit
      default: false
      description: Maximum number of results to return (max 10000).
      isArray: false
      required: true
      secret: false
    - name: time_frame
      default: false
      description: Time frame in minutes back from now to query.
      isArray: false
      required: false
      secret: false
    - name: offset
      default: false
      description: Offset for paging.
      isArray: false
      required: false
      secret: false
    deprecated: false
    description: Gets events from Saviynt EIC. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.
    execution: false
    name: saviynt-eic-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam